1475e99a3c6f981c04ece1be7886a0ce78893f8a9060cba401e5d98029aab337

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 316KB
Sample260511-da42fady2l
SHA256 1475e99a3c6f981c04ece1be7886a0ce78893f8a9060cba401e5d98029aab337
MD5 5be0b879d7d107a16cc72d293c23b32a
SHA1 f9b55b1440212f8fec4540a34a038b97476279b7
SHA512 2d1915967874294aa4b98ebe1d7b38012e570071744c71accde07d4d732a573ea9bb5486177a8dea8b6070ba21b64df4b11cf77ba8c518eae17784351d815000
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZG6:dMgZXNOUBXXRTOAz+G6
TLSH
T10C647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4972	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4972	4492	2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_5be0b879d7d107a16cc72d293c23b32a_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 316KB
SHA256 db6f9be275169aa28c15387b679ab30bcd9616937e74ff54380537532ed33964
MD5 5307905b2c1727ee2c25f9d9a77c17a3
SHA1 26201e0f7a97248b4a9021e09abcee6ca9ee70c7
SHA512 acf40de2f6beddf4d6ed3fa5248df4a701822b8da807f718b0019197b89aac7b569574ae3a3874cdee65739ad162ca129e25ff1c321bbd7c4e6c7e8d35df7493
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGf:dMgZXNOUBXXRTOAz+Gf
TLSH
T1C3647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4492-5-0x0000000001410000-0x000000000145A000-memory.dmp

Download

memory/4972-6-0x0000000001440000-0x000000000148A000-memory.dmp