ec5f6e35d10a01da44ef44a17fd738c779d827b88aa9864d764b8def535cb2ad

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/05/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe
Size 344KB
Sample260527-tedytac161
SHA256 ec5f6e35d10a01da44ef44a17fd738c779d827b88aa9864d764b8def535cb2ad
MD5 bd9864208e8626e4988a1cbf1c7503d5
SHA1 c7253ee76492af5ff1a243b71a00301689ca8e27
SHA512 1d6877a2244d5590cd997243ba11cdc4a0f99f5d9b141515dac895d258a4a8009d35f953f4430f64854ef6c5e4d9d976fca7f487d25db73ecd67f3ff1160e06d
SSDEEP 6144:J7nNfnCWdDKyFOpE0LCy3hZngk4QZQ6/4Cq:JJfn9d2yFOpE0LCihZg9QZhR
TLSH
T18B749D2273D0E472C5D324718F9693A689BEBC711D6265876BD43B7D8F306C2DA34B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
8	1140	2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe
10	1140	2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-27_bd9864208e8626e4988a1cbf1c7503d5_amadey_darkgate_elex_mafia_remcos_rhadamanthys_stop.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1140-0-0x0000000000970000-0x00000000009CA000-memory.dmp

Download