f2afad565990384c210ed7d6548d6b2fc914ceeb58e6f776739dfe115ac8f0d8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/10/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-25_c1cb21827239b21c550af0a762f1bd98_amadey_darkgate_elex_smoke-loader.exe
Size 379KB
Sample261026-qpp72ses2w
SHA256 f2afad565990384c210ed7d6548d6b2fc914ceeb58e6f776739dfe115ac8f0d8
MD5 c1cb21827239b21c550af0a762f1bd98
SHA1 d23a0e0a7cbc6af2c2093b7287b82527441e357a
SHA512 4768794b106d166a3ffa452eb3832f8f45d747924a7abc10867e1b3288f2c14fbfa9e20250af1f145170cc0a909dd41d896ef2256ea804dfcbe5c33e642e8f54
SSDEEP 3072:qgarkE/V985Ft6l+BC3K5eqU+BC3K5eqYroJS:qhkCV985oK70K7NS
TLSH
T1EC848E00F3C1DD73E058263184A746720AB6ED1697A165AB17983FBFDDB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4140	lcysrkn.exe
2844	lcysrkn.exe
1652	lcysrkn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\lcysrkn.exe	2026-10-25_c1cb21827239b21c550af0a762f1bd98_amadey_darkgate_elex_smoke-loader.exe
File created	C:\PROGRA~3\Mozilla\lcysrkn.exe	lcysrkn.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4288	4140	WerFault.exe	90
4600	1652	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-25_c1cb21827239b21c550af0a762f1bd98_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcysrkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcysrkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lcysrkn.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4140	lcysrkn.exe
4140	lcysrkn.exe
1652	lcysrkn.exe
1652	lcysrkn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	lcysrkn.exe
Token: SeDebugPrivilege	1652	lcysrkn.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5972	4140	lcysrkn.exe	83
PID 1652 wrote to memory of 5972	1652	lcysrkn.exe	83

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:5972
- C:\Users\Admin\AppData\Local\Temp\2026-10-25_c1cb21827239b21c550af0a762f1bd98_amadey_darkgate_elex_smoke-loader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-10-25_c1cb21827239b21c550af0a762f1bd98_amadey_darkgate_elex_smoke-loader.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:5124

C:\PROGRA~3\Mozilla\lcysrkn.exe
"C:\PROGRA~3\Mozilla\lcysrkn.exe" -eblaoad
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 528
  2⤵
  - Program crash
  PID:4288

C:\PROGRA~3\Mozilla\lcysrkn.exe
C:\PROGRA~3\Mozilla\lcysrkn.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4140 -ip 4140
1⤵
PID:4796

C:\PROGRA~3\Mozilla\lcysrkn.exe
"C:\PROGRA~3\Mozilla\lcysrkn.exe" -eblaoad
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 512
  2⤵
  - Program crash
  PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1652 -ip 1652
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcysrkn.exe

Path C:\ProgramData\Mozilla\lcysrkn.exe
Size 379KB
SHA256 5507beaa811dcd0001f0ed429bee14dacd9c0759aa935e14b07ac804a0d4d173
MD5 3272b94c3707240ef824ab583486fc54
SHA1 23ae702e0b712cd4bc0e5937430e7847f1a5dc2d
SHA512 4f5331428efa4b0e86ecfcc30af1f2237f742e341e225e8dbf95214e1901f377fe6f55699e69269e32fa0221f995d13866938ba63f2353c591069e4f6bf37bc7
SSDEEP 3072:qgarkE/V985Ft6l+BC3K5eqU+BC3K5eqYroJi:qhkCV985oK70K7Ni
TLSH
T1E1848E00F3C1DD73E058263184A746720AB6ED1697A165AB17983FBFDDB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lcysrkn.exe

Path C:\ProgramData\Mozilla\lcysrkn.exe
Size 379KB
SHA256 c8793634e0224d120a5cddc01c0bc11d9f6f22bc062fdd377f26355589aa67b9
MD5 75347ccba2bc300d270cbc9b028e76bd
SHA1 3d1cbfc8378123604f8d4bfa53c7529093c59966
SHA512 013a360a6f60cdb202adbe6010ef949a3d38c03fd46d65b87e0cfe95e982759f0c089b668456ddfe148fe4796370a8658d76f31cb1d063125fefaf346d6c2017
SSDEEP 3072:qgarkE/V985Ft6l+BC3K5eqU+BC3K5eqYroJ7:qhkCV985oK70K7N7
TLSH
T1EE848E00F3C1DD73E058263184A746720AB6ED1697A165AB17983FBFDDB02A05A76F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2844-9-0x0000000000520000-0x000000000057EF00-memory.dmp

Download

memory/4140-4-0x0000000000528000-0x0000000000529000-memory.dmp

Download

memory/5124-0-0x0000000000488000-0x0000000000489000-memory.dmp

Download

memory/5972-6-0x00000000038F0000-0x000000000390C000-memory.dmp

Download