d9ad24938db9eb2762c9a06b189df84d33d7b799d503a3517f312311e6957ce5

General

Target
2026-11-09_5205ee5a3ddc0d0913ca3d666b2c474d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Size 109KB
Sample261110-yf8a9sae65
SHA256 d9ad24938db9eb2762c9a06b189df84d33d7b799d503a3517f312311e6957ce5
MD5 5205ee5a3ddc0d0913ca3d666b2c474d
SHA1 f20de675f939444ac7d6999002b51b6ecea891c5
SHA512 41a93bd96ddac04eb8b93d7fabf4a4cb1752da592651aa5531f2fb214588b5886b52ee2be0956e6e7a979aade867c6b5cefd8dd621dc746a9de58f0ec2f20201
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYro5:4GIAFGWIaDK70K7t
TLSH
T16EB38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4212	wqtjomh.exe
1556	wqtjomh.exe
1604	wqtjomh.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\wqtjomh.exe	2026-11-09_5205ee5a3ddc0d0913ca3d666b2c474d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
File created	C:\PROGRA~3\Mozilla\wqtjomh.exe	wqtjomh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3320	4212	WerFault.exe	89
5012	1604	WerFault.exe	95

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-09_5205ee5a3ddc0d0913ca3d666b2c474d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqtjomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqtjomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqtjomh.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4212	wqtjomh.exe
4212	wqtjomh.exe
1604	wqtjomh.exe
1604	wqtjomh.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	wqtjomh.exe
Token: SeDebugPrivilege	1604	wqtjomh.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4212 wrote to memory of 1200	4212	wqtjomh.exe	81
PID 1604 wrote to memory of 1200	1604	wqtjomh.exe	81

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:1200
- C:\Users\Admin\AppData\Local\Temp\2026-11-09_5205ee5a3ddc0d0913ca3d666b2c474d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-11-09_5205ee5a3ddc0d0913ca3d666b2c474d_amadey_darkgate_elex_karagany_rhadamanthys_smoke-loader_stealc.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3712

C:\PROGRA~3\Mozilla\wqtjomh.exe
"C:\PROGRA~3\Mozilla\wqtjomh.exe" -hewmpdf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 528
  2⤵
  - Program crash
  PID:3320

C:\PROGRA~3\Mozilla\wqtjomh.exe
C:\PROGRA~3\Mozilla\wqtjomh.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4212 -ip 4212
1⤵
PID:1700

C:\PROGRA~3\Mozilla\wqtjomh.exe
"C:\PROGRA~3\Mozilla\wqtjomh.exe" -hewmpdf
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 500
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1604 -ip 1604
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wqtjomh.exe

Path C:\ProgramData\Mozilla\wqtjomh.exe
Size 109KB
SHA256 6e749d36c89a5e16591cb616e5e9dd2253a1fad3a646a480bdf71a2490121ea9
MD5 efa733e5ae192b4a33bbe2998b027b7b
SHA1 eb19547cf6538cd866a4604fcd797a33f45aaa89
SHA512 386f496b3de6569c027dd23901e1abb8bf296c628d64ebd102ee4027b01411e542c0e5b8c553d34d70b5a9f82973db84f29dffaa856a018ecb67c7883294c3eb
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYroH:4GIAFGWIaDK70K7L
TLSH
T199B38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqtjomh.exe

Path C:\ProgramData\Mozilla\wqtjomh.exe
Size 109KB
SHA256 edbec73884001ae88366af817ab5bc6c5e601c1696df31ce618da636d8536c52
MD5 cc86d99373e9f89d24af1452199acf0e
SHA1 8be362248b803bb0cc67fe24424fe53f08a798aa
SHA512 6c3f2943ee8a35b7d0990c0c21a5ddc33a41cbe3e3ea0fdcb47fbf8765c8a131ccf060bd2a3464529c5456095300e1e81a26cc0c437a7f859b94c683a81ecf11
SSDEEP 3072:x7TeP+Oa8AFGTsZI5e+Mp+BC3K5eqU+BC3K5eqYro2:4GIAFGWIaDK70K7a
TLSH
T14AB38E41F3D0DD66E05C253184A746B30BB5EC1697B135AB27883BAFDD702A05A7AF0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-5-0x0000000002CC0000-0x0000000002CDC000-memory.dmp

Download

memory/1556-9-0x00000000001B0000-0x000000000020F000-memory.dmp

Download

memory/1604-12-0x0000000000AB0000-0x0000000000B0F000-memory.dmp

Download

memory/3712-1-0x0000000000830000-0x000000000088F000-memory.dmp

Download

memory/4212-6-0x00000000001B0000-0x000000000020F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads