ae8810ff8c7b1cdc6433a5e6e0e8f4ba1ba72f0270e1fee06a05c753453c445d

Analysis

max time kernel
149s
max time network
146s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_68be573524c586e205b8c57e671cdd69_amadey_darkgate_elex_hellokitty.exe
Size 1.3MB
Sample260505-hypc4sd14r
SHA256 ae8810ff8c7b1cdc6433a5e6e0e8f4ba1ba72f0270e1fee06a05c753453c445d
MD5 68be573524c586e205b8c57e671cdd69
SHA1 e3865ad87c85e868563e37fba976eee2152f05e2
SHA512 a4fb9cade1e439476a7f18a0648e25b5b0fa0c416e6e16bf36ca0f5e4e187b0975902e03fac154906d6198f1eb5c17d45213b8ff2cc72c56a41ae847230a52b8
SSDEEP 12288:2pkbi5qjhZ3CmW9lsq+eY4mK1ZAvmix9eqqKejiQiiFq0a2Sj:r1hUmVxeY4mK1Ovmix9eqUX1W
TLSH
T151559442FBA4C585F37003F9D88B19A871679E80D1B56BA3FB467E87B0794D20819FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_68be573524c586e205b8c57e671cdd69_amadey_darkgate_elex_hellokitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1544	timeout.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2328	4832	2026-05-05_68be573524c586e205b8c57e671cdd69_amadey_darkgate_elex_hellokitty.exe	78
PID 2328 wrote to memory of 1544	2328	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-05_68be573524c586e205b8c57e671cdd69_amadey_darkgate_elex_hellokitty.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_68be573524c586e205b8c57e671cdd69_amadey_darkgate_elex_hellokitty.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\timeout.exe
    TIMEOUT /T 1 /NOBREAK
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

del.cmd

Path C:\Users\Admin\AppData\Local\Temp\del.cmd
Size 194B
SHA256 c4bd53526d5e33b132d418df85474d2b11c5d61fdd5f546d69896828cd855caa
MD5 72b77075fb9122c1a64147c5cb378b21
SHA1 74a5553892e5d608924542d8819af42fd52959ea
SHA512 b0cfe50416b3078b7d49d1249e40cdfc7376f8cf1644dbebad0884c196453f69acf44e117d1a0002767f42760f08e670fc5738fc7e1640351e80acb098a99cea
TLSH
T1B4C022E150ADDA982044B0034BE7968DD41404CA3F643F003344C44C10CA43DF1C3E41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4832-0-0x0000000004810000-0x0000000004874000-memory.dmp

Download

memory/4832-4-0x0000000004810000-0x0000000004874000-memory.dmp