Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/10/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
- Size 400KB
- Sample261029-weld1a115k
- SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
- MD5 055732476a4601b151a711902448c7e9
- SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
- SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
- SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
- TLSH T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 7148 rhurn3zbprrrpqikk4umi.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 18716 kxyxzkcujf.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ejtyqozq\xp6nua ravltqvb.exe File created C:\Windows\ejtyqozq\xp6nua kxyxzkcujf.exe File created C:\Windows\ejtyqozq\xp6nua 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe File created C:\Windows\ejtyqozq\xp6nua rhurn3zbprrrpqikk4umi.exe File created C:\Windows\ejtyqozq\xp6nua kxyxzkcujf.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname kxyxzkcujf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain kxyxzkcujf.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhurn3zbprrrpqikk4umi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kxyxzkcujf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 10912 kxyxzkcujf.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 14796 ravltqvb.exe 10912 kxyxzkcujf.exe 10912 kxyxzkcujf.exe 14796 ravltqvb.exe 14796 ravltqvb.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2692 wrote to memory of 7148 2692 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe 87 PID 10912 wrote to memory of 14796 10912 kxyxzkcujf.exe 92 PID 7148 wrote to memory of 18716 7148 rhurn3zbprrrpqikk4umi.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\ejtyqozq\rhurn3zbprrrpqikk4umi.exe"C:\ejtyqozq\rhurn3zbprrrpqikk4umi.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7148 -
C:\ejtyqozq\kxyxzkcujf.exe"C:\ejtyqozq\kxyxzkcujf.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:18716
-
-
-
C:\ejtyqozq\kxyxzkcujf.exeC:\ejtyqozq\kxyxzkcujf.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:10912 -
C:\ejtyqozq\ravltqvb.exepi70ppxqpjaf "c:\ejtyqozq\kxyxzkcujf.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:14796
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ejtyqozq\rhurn3zbprrrpqikk4umi.exe
- Size 400KB
- SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
- MD5 055732476a4601b151a711902448c7e9
- SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
- SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
- SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
- TLSH T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ejtyqozq\wtsqnkxb
- Size 4B
- SHA256 57f934db478f3dc1ae612cf12108f917d2a70a0720c64993ad45d7ca1e1c75ad
- MD5 9688f5a9df5f56713310d4032ac6ad63
- SHA1 57cadf3b17e9530745fbd542608e8bfccf8dce49
- SHA512 9ba29cfe885e79ed047a7e25bc0165c1d4478099fae962e47fc1d86eaee15c32d70e3b4e9c03f948b5c17a603f0cf559a3c73697edf8bf8b464c47b0a3ae0d16
- MD5 SHA1 SHA512
- Path C:\ejtyqozq\xp6nua
- Size 12B
- SHA256 c761c181457c57ea1fdb829a1ba228bb108e650b2c210e45ed4f3c2fd768b061
- MD5 13c0a78fe9295816538c19abdf019c99
- SHA1 3cdf1f0d147fc1161e5bff270c6328be9751ff3b
- SHA512 8c88f6ccfd7a5ab868ff14c989d7692d0c63173c06ba3ce34311541163af99743471bd323935a6eb17d2704e02f58f7d1fca77926884c0a53e13f72a6db21906
- MD5 SHA1 SHA512