c8d233640fe648761b09cbd963cccfb19fe7dcd3a779a00d7b9f0d2285ddacfe

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ecd8394a73e553c7e4d0ad188ee5ecb8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 108KB
Sample261102-erphraea72
SHA256 c8d233640fe648761b09cbd963cccfb19fe7dcd3a779a00d7b9f0d2285ddacfe
MD5 ecd8394a73e553c7e4d0ad188ee5ecb8
SHA1 81da20f1aee1abf98f9bc9efa20dd069cd6487f4
SHA512 519c8488fd725ec68ac0c5a5dab69618b15bd6d1734fbe4db2545adc4dc53b832438de9b7bdc29c75df12e3383ec2ab4e89c11c004ccc64aab389851cc5dca1f
SSDEEP 3072:i+Oa8AFGusZI5e+Mp+BC3K5eqU+BC3K5eqYro+j:NIAFG3IaDK70K7qj
TLSH
T1AEB38E41F3C0DD66F05C253184A746B30BB5ED1697B125AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4976	oelftnj.exe
4948	oelftnj.exe
212	oelftnj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\oelftnj.exe	oelftnj.exe
File created	C:\PROGRA~3\Mozilla\oelftnj.exe	2026-11-01_ecd8394a73e553c7e4d0ad188ee5ecb8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2544	4976	WerFault.exe	89
4000	212	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_ecd8394a73e553c7e4d0ad188ee5ecb8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4976	oelftnj.exe
4976	oelftnj.exe
212	oelftnj.exe
212	oelftnj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	oelftnj.exe
Token: SeDebugPrivilege	212	oelftnj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 3292	4976	oelftnj.exe	56
PID 212 wrote to memory of 3292	212	oelftnj.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3292
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_ecd8394a73e553c7e4d0ad188ee5ecb8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_ecd8394a73e553c7e4d0ad188ee5ecb8_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3960

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe -tvlvzee
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 504
  2⤵
  - Program crash
  PID:2544

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4976 -ip 4976
1⤵
PID:4732

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe -tvlvzee
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 480
  2⤵
  - Program crash
  PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 212 -ip 212
1⤵
PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oelftnj.exe

Path C:\ProgramData\Mozilla\oelftnj.exe
Size 108KB
SHA256 53ed33569284c6a5542f34d9861192f167afc7573059cfdb11e8a31251b38c23
MD5 239e8ab3e1e27de3dd58fa46057bc3cd
SHA1 61e04b468260ffe906b563ea78f79219d6a4732e
SHA512 3cd06bada58e319525486aec09b4543246649d11db88a56fb62199cd50884e2d90fe347e68504f342e9b90ab63cc7ddc3d77079e45099b53a43f0ee5559b3b79
SSDEEP 3072:i+Oa8AFGusZI5e+Mp+BC3K5eqU+BC3K5eqYro+J:NIAFG3IaDK70K7qJ
TLSH
T1CEB38E41F3C0DD66F05C253184A746B30BB5ED1697B125AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oelftnj.exe

Path C:\ProgramData\Mozilla\oelftnj.exe
Size 108KB
SHA256 52ca47c041f127dac0ca1f9b4f9a6df1e95953ccb94612fe1bae3004eadd0f23
MD5 9932e22206511133457b5055df9b26ed
SHA1 3a86c6431ec2b0224af996f5e2fb089b156ea310
SHA512 754c57b1fda797b4650d9afb4148739a65967883d65708df40116cebebc1f492dc23af6782e4c1e9a5fc58f1ae7486369c6091f5849608ca38f54526310df8ea
SSDEEP 3072:i+Oa8AFGusZI5e+Mp+BC3K5eqU+BC3K5eqYro+0:NIAFG3IaDK70K7q0
TLSH
T1EAB38E41F3C0DD66F05C253184A746B30BB5ED1697B125AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3292-4-0x0000000002BE0000-0x0000000002BFC000-memory.dmp

Download

memory/4948-8-0x0000000000A90000-0x0000000000AEF000-memory.dmp

Download