Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe
- Size 400KB
- Sample261029-weld1a115k
- SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
- MD5 055732476a4601b151a711902448c7e9
- SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
- SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
- SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
- TLSH T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
pid Process 7876 rhurn3zbsp8rpqikk4umi.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 19200 kxyxzkcujf.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ejtyqozq\xp6nua kxyxzkcujf.exe File created C:\Windows\ejtyqozq\xp6nua ravltqvb.exe File created C:\Windows\ejtyqozq\xp6nua kxyxzkcujf.exe File created C:\Windows\ejtyqozq\xp6nua 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe File created C:\Windows\ejtyqozq\xp6nua rhurn3zbsp8rpqikk4umi.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname kxyxzkcujf.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain kxyxzkcujf.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhurn3zbsp8rpqikk4umi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kxyxzkcujf.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 15400 ravltqvb.exe 11612 kxyxzkcujf.exe 11612 kxyxzkcujf.exe 15400 ravltqvb.exe 15400 ravltqvb.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1704 wrote to memory of 7876 1704 2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe 90 PID 11612 wrote to memory of 15400 11612 kxyxzkcujf.exe 92 PID 7876 wrote to memory of 19200 7876 rhurn3zbsp8rpqikk4umi.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-29_055732476a4601b151a711902448c7e9_darkgate_elex_hawkeye_maze_remcos_stealc.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\ejtyqozq\rhurn3zbsp8rpqikk4umi.exe"C:\ejtyqozq\rhurn3zbsp8rpqikk4umi.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:7876 -
C:\ejtyqozq\kxyxzkcujf.exe"C:\ejtyqozq\kxyxzkcujf.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:19200
-
-
-
C:\ejtyqozq\kxyxzkcujf.exeC:\ejtyqozq\kxyxzkcujf.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:11612 -
C:\ejtyqozq\ravltqvb.exepi70ppxqpjaf "c:\ejtyqozq\kxyxzkcujf.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:15400
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:9212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ejtyqozq\rhurn3zbsp8rpqikk4umi.exe
- Size 400KB
- SHA256 659275c1fb82c7631ccc200a73c38841eafce776bfad8712cbbdf099fb530aed
- MD5 055732476a4601b151a711902448c7e9
- SHA1 61607b7bc4b52fa8470bab842ba326cd06368f61
- SHA512 7b45e2de7a50ff207c96dc96e2ac7dba44d5727748bdedc685c85fff188a506bebfc5cdf9a6eb8d678b14f406c91d68dc08de73389e2f9229eee13484bece602
- SSDEEP 12288:7wNdg2w9xtb6ruQmft1+B/5jrBuPAWONk:MN36j6ruPl1+B/JMUNk
- TLSH T174945C04B190D43DE1A251FA4969F62242BCBAA233B595C7BFD84D4D4BB48E07B3731B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ejtyqozq\wtsqnkxb
- Size 4B
- SHA256 c47b51911db291b4b00a1963370bc0069c126d6402a8577eeefc958d54bb71ee
- MD5 37be9cb5e79a629ff2461f7a2d1be8cd
- SHA1 70baaf0695bcbb5b0406b4441e35e81f26c9baec
- SHA512 5fef1d662953ab3a983a82db04677625578b33401e89a84d7e0e90216d800a1d0a4f91941cbadaf7b67cda582160079ae5484b67fb3e7c724400f683aeb2ede1
- MD5 SHA1 SHA512
- Path C:\ejtyqozq\xp6nua
- Size 12B
- SHA256 c761c181457c57ea1fdb829a1ba228bb108e650b2c210e45ed4f3c2fd768b061
- MD5 13c0a78fe9295816538c19abdf019c99
- SHA1 3cdf1f0d147fc1161e5bff270c6328be9751ff3b
- SHA512 8c88f6ccfd7a5ab868ff14c989d7692d0c63173c06ba3ce34311541163af99743471bd323935a6eb17d2704e02f58f7d1fca77926884c0a53e13f72a6db21906
- MD5 SHA1 SHA512