3ff6458aa705a9c4eec8fa4f58990f2bef46efabfd25c95dc57adefbff5a2730

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_6c63c834051de432de95483e8773ddab_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Size 1.8MB
Sample260415-szdm4set6s
SHA256 3ff6458aa705a9c4eec8fa4f58990f2bef46efabfd25c95dc57adefbff5a2730
MD5 6c63c834051de432de95483e8773ddab
SHA1 bd71c34d9e17b3e2eb26d8b02782a11ea949e05d
SHA512 f26042fed46410a2908b76d239f6fa9b9bb0529212e71e221c45294e2586c22f34c712f6d3f7ededee1c56ee2f7565d3d793e2c115668074bb02baa2e70788ef
SSDEEP 12288:iaYeiveC8omNZHsyClgmw6zxV7nAwSfxL/2Dc3jDLLmt0LDQewsAjRoNPRXCbwt:mw/rHaewsAj+1RXDt
TLSH
T1D8950612B558D02ACC6F1EB05519CBB6F9346E5F7F1E78836E803A6D2A735C2A431327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_6c63c834051de432de95483e8773ddab_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c63c834051de432de95483e8773ddab_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c63c834051de432de95483e8773ddab_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2948-0-0x0000000000400000-0x000000000048E000-memory.dmp

Download