489429bf24d3732c1afeb9d38a5bec7053d84b27ba7f7867ea428fda4523c3d1

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 07:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 315KB
Sample260509-jt7vbsc13x
SHA256 489429bf24d3732c1afeb9d38a5bec7053d84b27ba7f7867ea428fda4523c3d1
MD5 b8da6e5dc5c713767ca4402be2ee67e9
SHA1 e48e76eca9e8fef1a7b59a775a465ab739146b9d
SHA512 a3b9b6bb0a8b44bf18af8f3f3a5aaa05f273db30eb37848c409ad74f9089ab852d1938f3e6a8b134bd280c0ba2a46228422ca7d81cb077cdaf1718bcd4ddec33
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGw:dMgZXNOUBXXRTOAz+Gw
TLSH
T181647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4780	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4780	2008	2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-05-09_b8da6e5dc5c713767ca4402be2ee67e9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 315KB
SHA256 24b0ed18a0a6f056c4b117e46b8a1e6a23f5ba99615f29750eb5dc4ccc585723
MD5 dc64d610d359f96b43abb60ba126e93d
SHA1 46038b2355a797312bcf7f59bea5273d39fdb184
SHA512 25562b02647b7182e18e5eb27488f6068b441b0fdc836df77459f718c15e643b870c3fb87da2537c457039ff939f768bc671bf143862117612154a645de5630f
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZG1:dMgZXNOUBXXRTOAz+G1
TLSH
T116647B02A6718072DB6A073B4052E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-4-0x00000000015F0000-0x00000000016B2000-memory.dmp

Download

memory/4780-6-0x0000000001020000-0x00000000010E2000-memory.dmp