e6965b0fa20265991b570770c6f4125d6baf1dbe549788914670af22cebf6f63

General

Target
2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.0MB
Sample260415-pmfedsd18p
SHA256 e6965b0fa20265991b570770c6f4125d6baf1dbe549788914670af22cebf6f63
MD5 e932f130b43d699492806d437e504f6c
SHA1 cb0bce54a6e3591c07b13232c9afb4631952bd1e
SHA512 dd763ed0dfbf1444d331173f092d9b6f289b2006b45ce0e63e0db53eee89c2091f95c215131e76d276598f5024ba796c660400d82d7fec51256e3d392f4ce744
SSDEEP 12288:/QFr8XPSlHuXSExoe4Te9niuBahyqDC8hph1Dn2FGvZe4OUEqTj:Ix8XP8kmTIV8Fp2FGvZe4Ok
TLSH
T1CE25B021B550E029E89714B25DEFC7695628BFB0171920C3B2C17FDE2AB17E26B37607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5952	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2368	jOhNa70000.exe
1032	jOhNa70000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jOhNa70000 = "C:\\ProgramData\\jOhNa70000\\jOhNa70000.exe"	jOhNa70000.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jOhNa70000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jOhNa70000.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	jOhNa70000.exe
Token: SeDebugPrivilege	1032	jOhNa70000.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2368	jOhNa70000.exe
2368	jOhNa70000.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2368	jOhNa70000.exe
2368	jOhNa70000.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2368	jOhNa70000.exe
2368	jOhNa70000.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2368	3264	2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	78
PID 3264 wrote to memory of 5952	3264	2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	79
PID 3264 wrote to memory of 5952	3264	2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_e932f130b43d699492806d437e504f6c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264
- C:\ProgramData\jOhNa70000\jOhNa70000.exe
  C:\ProgramData\jOhNa70000\jOhNa70000.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:2368
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:5952

C:\ProgramData\jOhNa70000\jOhNa70000.exe
C:\ProgramData\jOhNa70000\jOhNa70000.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jOhNa70000

Path C:\ProgramData\jOhNa70000\jOhNa70000
Size 48B
SHA256 12527936d045a9286c022c4583f109bbd5b0248584e6535c7b52cf80fc339113
MD5 711de768abf34310d15c29a81e374cf0
SHA1 87c593fd480fadbc735cf9b6baf6309303289fab
SHA512 d37e4aa43dde167205fe128e3146e164bb9f16dc9898d0f6a1342999f7b4f6625dbf660e76009f132c61d06179ac4aa136c696ee5edd0163dd2e931e4480e678
MD5 SHA1 SHA512

Submit Download

jOhNa70000.exe

Path C:\ProgramData\jOhNa70000\jOhNa70000.exe
Size 1.0MB
SHA256 0e06f432f91f4554a3f04e0dbbe5cd2ebc7e522b5d319a035f7a6a5d4670fc49
MD5 bc8254ecb2d7140cdfd4b6abca4cabd8
SHA1 9cae18f2ad6d1cb7a2da6a55a99bb61b05fa3d63
SHA512 3c03a584b4753151d0c29f67d518c25cddd06cab9798425eb1f8b1581345365ede0b883a112c8602496990611f4c3306be18879dcf780ca5eaf6d78b0672bd55
SSDEEP 12288:dQFr8XPSlHuXSExoe4Te9niuBahyqDC8hph1Dn2FGvZe4OUEqTj:Cx8XP8kmTIV8Fp2FGvZe4Ok
TLSH
T16725B021B550E029E89714B25DEFC7695628BFB0171920C3B2C17FDE2AB17E26B37607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-11-0x00000000002E7000-0x00000000002E8000-memory.dmp

Download

memory/3264-0-0x0000000000C07000-0x0000000000C08000-memory.dmp

Download

memory/5952-7-0x00000000001C0000-0x00000000001C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads