f2a54ef1bcb5bd65daeeca66b5e45eb8cf63c76423ba2f4d2379f05dc85593b9

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_ba19632d51b04184af8fc287300171aa_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample261102-mj79wsvt6j
SHA256 f2a54ef1bcb5bd65daeeca66b5e45eb8cf63c76423ba2f4d2379f05dc85593b9
MD5 ba19632d51b04184af8fc287300171aa
SHA1 d0273d33207eb1f72668952d2de7f6dd320ae1b9
SHA512 3394accb27a27fc3c75d2db6247914207447da25956f308f8a18bfdf8e51aa01760491cd2ca900f18be4944fddb91901209f811997990bf301e895f832a33891
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtm:mh7c5dFK70K7N8
TLSH
T159B38E41F3C0DD62E05C2531C46746B20BB9ED16A7B165AB17883BAFDD702A05E7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3084	qrtmmzh.exe
4160	qrtmmzh.exe
3216	qrtmmzh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\qrtmmzh.exe	2026-11-01_ba19632d51b04184af8fc287300171aa_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\qrtmmzh.exe	qrtmmzh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3900	3084	WerFault.exe	90
5892	3216	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtmmzh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_ba19632d51b04184af8fc287300171aa_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtmmzh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qrtmmzh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3084	qrtmmzh.exe
3084	qrtmmzh.exe
3216	qrtmmzh.exe
3216	qrtmmzh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3084	qrtmmzh.exe
Token: SeDebugPrivilege	3216	qrtmmzh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3084 wrote to memory of 1948	3084	qrtmmzh.exe	80
PID 3216 wrote to memory of 1948	3216	qrtmmzh.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1948
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_ba19632d51b04184af8fc287300171aa_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_ba19632d51b04184af8fc287300171aa_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3392

C:\PROGRA~3\Mozilla\qrtmmzh.exe
"C:\PROGRA~3\Mozilla\qrtmmzh.exe" -fvmqdbk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 528
  2⤵
  - Program crash
  PID:3900

C:\PROGRA~3\Mozilla\qrtmmzh.exe
C:\PROGRA~3\Mozilla\qrtmmzh.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3084 -ip 3084
1⤵
PID:5456

C:\PROGRA~3\Mozilla\qrtmmzh.exe
"C:\PROGRA~3\Mozilla\qrtmmzh.exe" -fvmqdbk
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 508
  2⤵
  - Program crash
  PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3216 -ip 3216
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qrtmmzh.exe

Path C:\ProgramData\Mozilla\qrtmmzh.exe
Size 109KB
SHA256 e760c6c6503709463b6f5eabd8dd90dd0c15a749222fa0ceb2feadb35468c01a
MD5 3030ea573c4b5747efce8ec7318243aa
SHA1 43d7e5085d6a7c46b1ebf5abf15021266282bd22
SHA512 df03e678697facbe6a10a41c42039cfb14d03afe5ba847c0500c423c2cf25d71ca91cd40873c9984e9514001bdbf633444ab46a6641ae4111b2fbf86a5711353
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtu:mh7c5dFK70K7Nc
TLSH
T109B38E41F3C0DD62E05C2531C46746B20BB9ED16A7B165AB17883BAFDD702A05E7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qrtmmzh.exe

Path C:\ProgramData\Mozilla\qrtmmzh.exe
Size 109KB
SHA256 9d0c9d84cd92c9d31db6b2d7dd8d485499c756a6fd50f07af176cf46afda5986
MD5 08ee3f6df56a490abd969e99fe6559c7
SHA1 d84975b0c3cd62afffc977de8dc298bffd15d1af
SHA512 db39e18bec84e697d91e251322e189172fa5b7c6333398470837d050d586af17eac4eb38526ad1a9d1ba396112361d7698da475968461b663f3a9bca51031a00
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtw:mh7c5dFK70K7Ne
TLSH
T14BB38E41F3C0DD62E05C2531C46746B20BB9ED16A7B165AB17883BAFDD702A05E7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-4-0x0000000003400000-0x000000000341C000-memory.dmp

Download

memory/4160-7-0x0000000000740000-0x000000000079F000-memory.dmp

Download