02acf539335bde91f2db6501ddeceff05b4d39e6e9d724524b22e96c7d2675db

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-09_8af8acb2119156e0589953e896a2963e_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample261110-ql9saaff55
SHA256 02acf539335bde91f2db6501ddeceff05b4d39e6e9d724524b22e96c7d2675db
MD5 8af8acb2119156e0589953e896a2963e
SHA1 9edd711883fdcae5bb08bdb99001567f1d437435
SHA512 0daeee4f30e7f2f53e1879fcd7fd7ea0c7a5e62e223d28e6c05143edf8eae549ff4b94ae832838ab594b09b8e52061aad5d63010bff22ac1c55d7a69b6afe762
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtM:mh7c5dFK70K7NG
TLSH
T168B38E41F3C0DD62E05C2531C46746B20BB5FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2752	oelftnj.exe
2164	oelftnj.exe
1100	oelftnj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\oelftnj.exe	2026-11-09_8af8acb2119156e0589953e896a2963e_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\oelftnj.exe	oelftnj.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4888	2752	WerFault.exe	89
3408	1100	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_8af8acb2119156e0589953e896a2963e_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oelftnj.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2752	oelftnj.exe
2752	oelftnj.exe
1100	oelftnj.exe
1100	oelftnj.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	oelftnj.exe
Token: SeDebugPrivilege	1100	oelftnj.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 3288	2752	oelftnj.exe	56
PID 1100 wrote to memory of 3288	1100	oelftnj.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3288
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_8af8acb2119156e0589953e896a2963e_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_8af8acb2119156e0589953e896a2963e_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3604

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe -tvlvzee
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 504
  2⤵
  - Program crash
  PID:4888

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2752 -ip 2752
1⤵
PID:2900

C:\PROGRA~3\Mozilla\oelftnj.exe
C:\PROGRA~3\Mozilla\oelftnj.exe -tvlvzee
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1100 -s 484
  2⤵
  - Program crash
  PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1100 -ip 1100
1⤵
PID:1572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

oelftnj.exe

Path C:\ProgramData\Mozilla\oelftnj.exe
Size 109KB
SHA256 7ea36ad1a9cbf90cba300887948f62b9c65af7ef5937d4a5316f7526b393fb26
MD5 e05d84ec79e57a6839b0c223655fe94a
SHA1 e1cda031206494e1120f415b5cfbbbfbb08db7c1
SHA512 08f1e6e29d9e6a3c7b2e9f08eac64aa57614479cf7ddc81b07f678ef81c8fdb859109e8620c7f92e44aefa69b1ea78449d2e579b8ec8162830b8146c649ad8b1
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtX:mh7c5dFK70K7Nl
TLSH
T152B38E41F3C0DD62E05C2531C46746B20BB9FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oelftnj.exe

Path C:\ProgramData\Mozilla\oelftnj.exe
Size 109KB
SHA256 48dc5168147042aa4a761079153928ed77136b4bd31779fd7568872f53a2e56c
MD5 0cc9b58e25e60c12ac74bdfd387697e2
SHA1 d66203026075cb78e28a73652b793cc910620f79
SHA512 534c57912e782c60002087cbcc81ce61e1d725a5a2b584bd358f722ab0130fd53e20140faf2f911e4ee852758691db706d7acfa8ece3a2fff047f09ba3c86c2b
SSDEEP 3072:mAayGHbc5sta5L+BC3K5eqU+BC3K5eqYroJtd:mh7c5dFK70K7N3
TLSH
T1EEB38E41F3C0DD62E05C2531C46746B20BB9FD16A7B165AB17883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2164-8-0x0000000000430000-0x000000000048F000-memory.dmp

Download

memory/3288-4-0x0000000002960000-0x000000000297C000-memory.dmp

Download