1475e99a3c6f981c04ece1be7886a0ce78893f8a9060cba401e5d98029aab337

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 316KB
Sample260511-da42fady2l
SHA256 1475e99a3c6f981c04ece1be7886a0ce78893f8a9060cba401e5d98029aab337
MD5 5be0b879d7d107a16cc72d293c23b32a
SHA1 f9b55b1440212f8fec4540a34a038b97476279b7
SHA512 2d1915967874294aa4b98ebe1d7b38012e570071744c71accde07d4d732a573ea9bb5486177a8dea8b6070ba21b64df4b11cf77ba8c518eae17784351d815000
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZG6:dMgZXNOUBXXRTOAz+G6
TLSH
T10C647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1112	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1112	5020	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 316KB
SHA256 96ff0ac8e24ede50a7c99515ffc51bb16a7b5475c8dade6b04398070669f26c5
MD5 c342289cab4345d45280e29c6132b73a
SHA1 64b98772cf0fde4611cba9acaac794300efd623d
SHA512 4c8aa2304fa99c353ac643b43b39b816c5b119397bd2839f901a9d41fe85779708d536607118eebc399242537ddaa2690b2623a163290a5e2cb98a4dc32a7e38
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGH:dMgZXNOUBXXRTOAz+GH
TLSH
T170647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download