ef8d02854928cc0ab43ceb62c581763d04c68e052829673d12a1a7324cc160c6

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample261024-xhqcssbx5y
SHA256 ef8d02854928cc0ab43ceb62c581763d04c68e052829673d12a1a7324cc160c6
MD5 257862e4d38dc2c4aa9e4008c706ff60
SHA1 fe689f0a646176cb5e5d683e77d978c01afbbbd2
SHA512 425a804bbaa23d7a707095d36114507985fb7596268de7f34cdbec43ad0bf7776f9054555ee4672023531fea00d4b72635b0316f70c778c7817f60e764ea2484
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJt6:mh7c5dFK70K7Nk
TLSH
T186B38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3432	npfmmcc.exe
5048	npfmmcc.exe
4416	npfmmcc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\npfmmcc.exe	2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\npfmmcc.exe	npfmmcc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1404	3432	WerFault.exe	88
3356	4416	WerFault.exe	97

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3432	npfmmcc.exe
3432	npfmmcc.exe
4416	npfmmcc.exe
4416	npfmmcc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	npfmmcc.exe
Token: SeDebugPrivilege	4416	npfmmcc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 3272	3432	npfmmcc.exe	56
PID 4416 wrote to memory of 3272	4416	npfmmcc.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5108

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe -ngupqza
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 504
  2⤵
  - Program crash
  PID:1404

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3432 -ip 3432
1⤵
PID:2612

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe -ngupqza
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4416 -s 484
  2⤵
  - Program crash
  PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4416 -ip 4416
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

npfmmcc.exe

Path C:\ProgramData\Mozilla\npfmmcc.exe
Size 109KB
SHA256 a47a77d3c4cedacf4711008c69d865be01f0f3a9b71e60f488a0ca27fb9d1150
MD5 675bd4705c377c535a7f9d821c22ab46
SHA1 1da3b5089e2a534e0a80585f07f9ff3416802b2e
SHA512 ebe1ed9c5f176f5f9d11f9a0398b36b6fd0359b4227cf56399db898072ff9c4c21385a7b6122eef934ee78d71ebac15fa487fc4dc170f0c931a1207a28292d31
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtM:mh7c5dFK70K7Ne
TLSH
T10AB38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npfmmcc.exe

Path C:\ProgramData\Mozilla\npfmmcc.exe
Size 109KB
SHA256 97897adf2bb4cc0becec9c82a1dbe342dfed365dbd15455cc6b8387888c3bcbc
MD5 7d72e258aadbd5b83a9e18c83e8aab5f
SHA1 df6c425132f342c2be6e61d6ef57c2ff16b0f52a
SHA512 103ce817b8a3b170b8845a08d4185b30580719c56ccecda068623a3ce86d02785fd6fafb8755b4109d1307d6204057a49e9fd64fa492e6d588b9712f0ceee66d
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtJ:mh7c5dFK70K7N3
TLSH
T1DAB38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3272-4-0x0000000002C80000-0x0000000002C9C000-memory.dmp

Download

memory/5048-8-0x0000000000910000-0x000000000096F000-memory.dmp

Download