911eab9136bbd5f08ba7679a4ef7dac4734fb359610b07f5223332305dce2af7

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample261102-ps1mhswt4p
SHA256 911eab9136bbd5f08ba7679a4ef7dac4734fb359610b07f5223332305dce2af7
MD5 a6f1c94b3d9a3f912df8e98228e484b0
SHA1 314c24ab314cf5258e1a38e33ec2260e3551590e
SHA512 b453d176aa89aebb87217e0fdbfafadd8fd78216f0357a9d6854ffa3578b7919d618b6d537134c09854a498422e61daf1d798b065e857c000f0927b7d309f83f
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroe:yIAFGzIaeK70K7C
TLSH
T1EBB38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
5064	npfmmcc.exe
1168	npfmmcc.exe
208	npfmmcc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\npfmmcc.exe	2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\npfmmcc.exe	npfmmcc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1796	5064	WerFault.exe	89
3652	208	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npfmmcc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5064	npfmmcc.exe
5064	npfmmcc.exe
208	npfmmcc.exe
208	npfmmcc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5064	npfmmcc.exe
Token: SeDebugPrivilege	208	npfmmcc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3264	5064	npfmmcc.exe	56
PID 208 wrote to memory of 3264	208	npfmmcc.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3264
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3420

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe -ngupqza
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 504
  2⤵
  - Program crash
  PID:1796

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5064 -ip 5064
1⤵
PID:3740

C:\PROGRA~3\Mozilla\npfmmcc.exe
C:\PROGRA~3\Mozilla\npfmmcc.exe -ngupqza
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 476
  2⤵
  - Program crash
  PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 208 -ip 208
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

npfmmcc.exe

Path C:\ProgramData\Mozilla\npfmmcc.exe
Size 107KB
SHA256 1c04c70fecc4608c0b7351b9c07c61eb0d876fe319fdefb4dad549e7e725f955
MD5 b2ce04d67111874c65ca2653af88ba8c
SHA1 02eaf750a3e47532493906be9cd46ad1cb5430ef
SHA512 c368a077a5f9455e0e1e38e163fa638044e38d592d8ae3e53ae759b1363e79455c60616408cac6e920009bc48e10cd0bd0f4bdfae3c537e77fcb340fa5a2b962
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYrow:yIAFGzIaeK70K7s
TLSH
T1B8B38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

npfmmcc.exe

Path C:\ProgramData\Mozilla\npfmmcc.exe
Size 107KB
SHA256 5ba29f851b6e64bad796626f175492a2e12fdfa1a2b161a42c479773499fe685
MD5 cd6365d7b05bc9989067ea98ca08e3de
SHA1 dc05dac2e5b9854d8707672a791847fe1f5b6439
SHA512 3dc9455cc1cd6dc0ad5c7133009773221ed9bbd40d7227ecb05cc3f0abf5abe083dbfa5404a71a60e04995d03eadee211150d9b56e4776ab35839591927a52f7
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYrom:yIAFGzIaeK70K7a
TLSH
T1B1B38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-8-0x0000000000A10000-0x0000000000A6EF1C-memory.dmp

Download

memory/3264-4-0x0000000001370000-0x000000000138C000-memory.dmp

Download