9df2c6b81bf5132536cce0947272d167bc2441cf9ede8abee62c7af26f38c1db

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 165KB
Sample261026-e8vfbsbz5t
SHA256 9df2c6b81bf5132536cce0947272d167bc2441cf9ede8abee62c7af26f38c1db
MD5 fedea611cda1e242e48189cdb02ecada
SHA1 ec09a8ca73acfc7b9210184a76a53a5fdfb5fe6d
SHA512 b5dc4cf23372295b44595065f4d9df324e5701140d9fc37aa0d83fa74f98440a1294be274e950e502fa69a58d4d69f5d0204cfcb1a23c198f72a58741c7fc13c
SSDEEP 3072:VCj9ikFff4CtZ6N6LGaMS5cdqTEtxeNwp92BTJKY8YL2tH54YHSSvd:VCj99Bf4MZWWGZS5cYFGq9KPYLOH5N7
TLSH
T1DBF3D01266A0C032D517867418B4E3AA5B3FFC2176318A9F37C903EEAF7168096B5767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4056	msiexec.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum	msiexec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4824	2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
4824	2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
4056	msiexec.exe
4056	msiexec.exe

Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
4056	msiexec.exe
4056	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4056	msiexec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4824 wrote to memory of 4056	4824	2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe	88
PID 4056 wrote to memory of 4060	4056	msiexec.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-25_fedea611cda1e242e48189cdb02ecada_amadey_andromeda_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Temp\#MSI\msiexec.exe
  "C:\Users\Admin\AppData\Local\Temp\#MSI\msiexec.exe"
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4056
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\syswow64\svchost.exe
    3⤵
    PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Defense Evasion

Process Injection

T1055

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

msiexec.exe

Path C:\Users\Admin\AppData\Local\Temp\#MSI\msiexec.exe
Size 62KB
SHA256 4de4957e8c7b4875f4a5ccc3ca6dd777953660409385b3489824888252840454
MD5 25fe12c5483a965a57d2bbddf05c50b4
SHA1 aba7331170b99a632641bf89d02dd5cb3234196d
SHA512 a8c0ec8ba454d7cb3a33fa97f6e2a41c386a54c82610b9de78279a910fd2896aab66bca57a4615cba1830cc858a74de58e9a388b2fdadb96255b0a0fe778033d
SSDEEP 1536:uDf4CJtC2+bVZc6wFmzm0GjGkHMRcD5sbZE2ojTEtxeo:of4CtZ6N6LGaMS5cdqTEtxeo
TLSH
T17553D0370260E217D95BCAB41CAA63CE96BFFD507200DFAF70D94AC9E7AC60145D2893
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4056-9-0x0000000000580000-0x0000000000594000-memory.dmp

Download

memory/4056-10-0x0000000000690000-0x0000000000692000-memory.dmp

Download

memory/4056-13-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4056-14-0x0000000000580000-0x0000000000594000-memory.dmp

Download

memory/4060-11-0x0000000000050000-0x000000000005F000-memory.dmp

Download