ef8d02854928cc0ab43ceb62c581763d04c68e052829673d12a1a7324cc160c6

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample261024-xhqcssbx5y
SHA256 ef8d02854928cc0ab43ceb62c581763d04c68e052829673d12a1a7324cc160c6
MD5 257862e4d38dc2c4aa9e4008c706ff60
SHA1 fe689f0a646176cb5e5d683e77d978c01afbbbd2
SHA512 425a804bbaa23d7a707095d36114507985fb7596268de7f34cdbec43ad0bf7776f9054555ee4672023531fea00d4b72635b0316f70c778c7817f60e764ea2484
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJt6:mh7c5dFK70K7Nk
TLSH
T186B38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3676	tsacjvd.exe
4576	tsacjvd.exe
4168	tsacjvd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\tsacjvd.exe	2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\tsacjvd.exe	tsacjvd.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5368	3676	WerFault.exe	90
4496	4168	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsacjvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsacjvd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsacjvd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3676	tsacjvd.exe
3676	tsacjvd.exe
4168	tsacjvd.exe
4168	tsacjvd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	tsacjvd.exe
Token: SeDebugPrivilege	4168	tsacjvd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 524	3676	tsacjvd.exe	81
PID 4168 wrote to memory of 524	4168	tsacjvd.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:524
- C:\Users\Admin\AppData\Local\Temp\2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-22_257862e4d38dc2c4aa9e4008c706ff60_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4732

C:\PROGRA~3\Mozilla\tsacjvd.exe
"C:\PROGRA~3\Mozilla\tsacjvd.exe" -zuezsjm
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 528
  2⤵
  - Program crash
  PID:5368

C:\PROGRA~3\Mozilla\tsacjvd.exe
C:\PROGRA~3\Mozilla\tsacjvd.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3676 -ip 3676
1⤵
PID:1860

C:\PROGRA~3\Mozilla\tsacjvd.exe
"C:\PROGRA~3\Mozilla\tsacjvd.exe" -zuezsjm
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 504
  2⤵
  - Program crash
  PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4168 -ip 4168
1⤵
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tsacjvd.exe

Path C:\ProgramData\Mozilla\tsacjvd.exe
Size 109KB
SHA256 f49d54769fbf44cbf7844f5890f61555f68409153cb98d18fac7b643990a74d3
MD5 1910e03eda3a8a124c5f89ef1662d332
SHA1 5300112bf0d0afaaa619b97c4e84154ad9b9fd82
SHA512 1750724950cf67588487941b060a68de46ab1fe871e56b790734176fed17a94b861f774c1b24535e221bc695ed3bd338f746074c7c71573548012b19e5b85e59
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtc:mh7c5dFK70K7Na
TLSH
T10EB38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsacjvd.exe

Path C:\ProgramData\Mozilla\tsacjvd.exe
Size 109KB
SHA256 e2629c52674b67853f2d072ab240d43ff3afea8ef731a956c5eaec68a01f051c
MD5 66a2e8e630f19d4c63a2ce11d03a1701
SHA1 0ccf68fa7ce4fbdb54766d3d07f84c0abdc3bbba
SHA512 a29996b4ee2dc7904e5c5b0bcdf3933a75edc18b983aa691663cf83274667271dfdac892fb13eab18b6e9815a2dd8dee4f67e5811cd1c4ce0c4796c479e757ee
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJte:mh7c5dFK70K7Ng
TLSH
T159B38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/524-4-0x0000000000E00000-0x0000000000E1C000-memory.dmp

Download

memory/4576-7-0x0000000000DC0000-0x0000000000E1F000-memory.dmp

Download