911eab9136bbd5f08ba7679a4ef7dac4734fb359610b07f5223332305dce2af7

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 107KB
Sample261102-ps1mhswt4p
SHA256 911eab9136bbd5f08ba7679a4ef7dac4734fb359610b07f5223332305dce2af7
MD5 a6f1c94b3d9a3f912df8e98228e484b0
SHA1 314c24ab314cf5258e1a38e33ec2260e3551590e
SHA512 b453d176aa89aebb87217e0fdbfafadd8fd78216f0357a9d6854ffa3578b7919d618b6d537134c09854a498422e61daf1d798b065e857c000f0927b7d309f83f
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroe:yIAFGzIaeK70K7C
TLSH
T1EBB38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4028	rusasea.exe
5468	rusasea.exe
4384	rusasea.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\rusasea.exe	2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\rusasea.exe	rusasea.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2860	4028	WerFault.exe	88
5472	4384	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rusasea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rusasea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rusasea.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4028	rusasea.exe
4028	rusasea.exe
4384	rusasea.exe
4384	rusasea.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	rusasea.exe
Token: SeDebugPrivilege	4384	rusasea.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 2352	4028	rusasea.exe	80
PID 4384 wrote to memory of 2352	4384	rusasea.exe	80

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2352
- C:\Users\Admin\AppData\Local\Temp\2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-01_a6f1c94b3d9a3f912df8e98228e484b0_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:476

C:\PROGRA~3\Mozilla\rusasea.exe
"C:\PROGRA~3\Mozilla\rusasea.exe" -oqbkgnc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 528
  2⤵
  - Program crash
  PID:2860

C:\PROGRA~3\Mozilla\rusasea.exe
C:\PROGRA~3\Mozilla\rusasea.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4028 -ip 4028
1⤵
PID:1040

C:\PROGRA~3\Mozilla\rusasea.exe
"C:\PROGRA~3\Mozilla\rusasea.exe" -oqbkgnc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4384 -s 512
  2⤵
  - Program crash
  PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4384 -ip 4384
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rusasea.exe

Path C:\ProgramData\Mozilla\rusasea.exe
Size 107KB
SHA256 9cdfe14bb83a6ecd77374559a4bf8a10eee7852c4d374ff5f2da51b77270b9aa
MD5 de90c0b8f9689b185b2ec7de47a04a8b
SHA1 2f11281e3775fcc9a51a6efdde3966fa1b1193e1
SHA512 e6b21ebe3da162c5907a7d85e1086411104387253610ca03acd231761d60248cd4406949d08a07c1951f6f090b1967981cb8d1bca659e19a096641a010b0c5d2
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYroS:yIAFGzIaeK70K7e
TLSH
T18BB38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rusasea.exe

Path C:\ProgramData\Mozilla\rusasea.exe
Size 107KB
SHA256 6d6c422aa3a55a54d808a4b6a1717e524f587402a7fba8f249cf080a43237b69
MD5 ee64bc6d7f88c679403b4da62f44e12e
SHA1 e9e642bfaeb7423d28bceababc4e0a6327264d63
SHA512 0ba3b0462ae749aa5876dbe47def61399d89e7bf601b02fe86ddcb2b085a3dc18df64d8b1ac31fe3af9618b91941f5cdd173ed753a35c6878a10cf81eb809993
SSDEEP 3072:L+Oa8AFGqsZI5e+MO+BC3K5eqU+BC3K5eqYro3:yIAFGzIaeK70K7D
TLSH
T1C1B38E41F3D0DD66F05C253180A746B20BB5EC1597B125AB27983BAFED702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2352-4-0x0000000003A50000-0x0000000003A6C000-memory.dmp

Download

memory/5468-7-0x0000000000810000-0x000000000086EF1C-memory.dmp

Download