489429bf24d3732c1afeb9d38a5bec7053d84b27ba7f7867ea428fda4523c3d1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 315KB
Sample260509-jt7vbsc13x
SHA256 489429bf24d3732c1afeb9d38a5bec7053d84b27ba7f7867ea428fda4523c3d1
MD5 b8da6e5dc5c713767ca4402be2ee67e9
SHA1 e48e76eca9e8fef1a7b59a775a465ab739146b9d
SHA512 a3b9b6bb0a8b44bf18af8f3f3a5aaa05f273db30eb37848c409ad74f9089ab852d1938f3e6a8b134bd280c0ba2a46228422ca7d81cb077cdaf1718bcd4ddec33
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGw:dMgZXNOUBXXRTOAz+Gw
TLSH
T181647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
264	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 264	1088	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 315KB
SHA256 d1c2103841eaae84512f293429a7cb83d13384ea3e7be794061040269da736c3
MD5 157e5855d85bb7293ac4d780c1a2f46a
SHA1 3deb6071e974f5300800c9564a0844ae03f38cb6
SHA512 fb26b7b6c00490270aca7d776f4ed2f8adda0fe67ee241407d4058a7b2a135da3b6a16c22877724640581dd2c0d7defccdef72c7c048da25604aab2d4ccc3ace
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGJ:dMgZXNOUBXXRTOAz+GJ
TLSH
T1C4647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download