ff5c5c2ff0b0d11958cd9876fb48f652f86af7b22743a5a37c67b02cac21ae1c

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 316KB
Sample260422-e6p3tsg14n
SHA256 ff5c5c2ff0b0d11958cd9876fb48f652f86af7b22743a5a37c67b02cac21ae1c
MD5 68a906673221a551b89605fc511399ae
SHA1 c6fe59fb600af799211baa835157ed3a8afcb575
SHA512 1665332c552c6f93fac5688b3102fb0f01cf32134062229ce8fe9d4934e2e684f32fe87897039259b81019bd571b5fcad975f53e93079b2a6d431acdec11cde5
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGq:dMgZXNOUBXXRTOAz+Gq
TLSH
T18F647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4616	2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4616	3912	2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-04-22_68a906673221a551b89605fc511399ae_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 316KB
SHA256 f35d169ce9ffdab3551846c6e01f2177fb778d22e50d28793e0be603c2761462
MD5 a6857da6387d80727e9ba696c7aca651
SHA1 2fc440b8d5215a79064ecec8859ce1bea00b82ed
SHA512 b81c30d5e063cd29775a82163bb50d935b5414d1fd6659eb86b756e71f9fd36bad5a180e5d4a3ee8af3fef913ff92b216a8869fab455f6686fbeb95d19f3ba7a
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGF:dMgZXNOUBXXRTOAz+GF
TLSH
T1E7647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download