3a5da9b3e0852cf55a76c7b767868fb99babdf7f8325ed14fa9613ad488c4b8b

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe
Size 1.1MB
Sample260629-dvt2zab14x
SHA256 3a5da9b3e0852cf55a76c7b767868fb99babdf7f8325ed14fa9613ad488c4b8b
MD5 bf5018323127600ffbc8ead99fc285b0
SHA1 219f40f6add237e238e195be0ea530b9b1504c94
SHA512 bbcaca6e61009d94ae56508845f22b15d45b730a60dea94ba200b0301e6b23f165cca2cc62726d178e0ccdf358078b088d91aad036d4e53fdb2c1534fdc3bd55
SSDEEP 12288:GaoVm94YoBGEtx0l874jrIWXg1MzBFnI8UChNXW5iuWXx:GDVm9cGUU4UBdI89hW5iuWXx
TLSH
T1D945190277E58179F1F37B71AEBA92645A77BCB09D36C50E27D1225E0970A80DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6084	AdobeARM32.exe
5948	eventviewer.exe

Loads dropped DLL 10 IoCs

pid	Process
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\syslog.exe	2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe
File created	C:\Windows\SysWOW64\eventviewer.exe	2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eventviewer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe
5948	eventviewer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6084	AdobeARM32.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 6084	5424	2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe	89
PID 5424 wrote to memory of 5948	5424	2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Users\Admin\AppData\Local\Temp\AdobeARM32.exe
  "AdobeARM32.exe "
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6084
- C:\Windows\SysWOW64\eventviewer.exe
  "C:\Windows\system32\eventviewer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0BD7EA52E65FB076EBB4C048B48576EA
Size 60KB
SHA256 0ae0b9f79edca66da4b568a055944a4d4d55f76d7a06c692c97ef3a978466c2a
MD5 3859bd304453d7f0f267d6977bfb3593
SHA1 9d35d944729ee716cc091688b1564664a3fe19fe
SHA512 afafb4c2d2e235b986a913e4ab1d8b1bbd85e2da187ed6ee077b39c350495a01ef7d8871f6801ea773a8f5a05cc35fddba08cfd9e38f9441c08556a2ecb28ce8
SSDEEP 1536:vo/dFPwAEiz3wacsOBzaa5o18VNSsDuULNW:A/7qVzamrSyW
TLSH
T153533E68EF77B264AD598E6A4EEAD69613E552D51E01030F0E307EB42F03AA7FF57000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F15827BEC5BABE89C21DCDAE77464BF1
Size 701B
SHA256 108dd34232a3088b45534933d0486409616a2bbad94fd8f7ab5991c01ff179b6
MD5 2b24bfcd271b4f2bd1bb9c58db53c20d
SHA1 12a18dbf2f27f02650e15c0d75e1bb7c50cf3d4b
SHA512 785dd247c3809434ad535b7c954c20c4d5661c00d9bf274fa9ca68595fd5dd98eced3b3e3602593da20bf810edd6b5f3592703176a61e15033267271b8750938
TLSH
T18F019E1983B02F025F801E462200D0628EFCF3DCAC243B89AAD9E8021805BA0A9D81DE
MD5 SHA1 SHA512 TLSH

Submit Download

0BD7EA52E65FB076EBB4C048B48576EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0BD7EA52E65FB076EBB4C048B48576EA
Size 246B
SHA256 37c84b18f0f5ef31a6056a108b5dc0ae84d717922229af91f0d5b49d8cda39a6
MD5 bdb3008699f5fd61dd5578c713527129
SHA1 838a79f9320ad7cd97af161234d639654018d81a
SHA512 b6194d1a6c16312600fbd414ccb8f3bb0ece0ad42ae7375739c57e6b401ea84a2ac8056510595bc69ff82b8622e4dc709f621d28ad92bd520ad44eca65b183a5
TLSH
T144D08C2CEB210339F0714277481141C2D5C08603B8919FBD0673128E8C39B220CB2D0C
MD5 SHA1 SHA512 TLSH

Submit Download

F15827BEC5BABE89C21DCDAE77464BF1

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F15827BEC5BABE89C21DCDAE77464BF1
Size 192B
SHA256 515d6edf6a604421262aa8e04c71891f1e6e9e1f54ceb317b3a438ecfaaf2573
MD5 b9a5bcf453eb0640effa4af9d2ec821f
SHA1 8cbaa1397beea265453f8c3a2844e91d95dfa4ac
SHA512 7b12e29beb35131931755458a31c130a05331563ca5265fb1df07b79e6d5f478d068e1ddff14a120c4f3b8ff4126760bc55f2d3b1b1955c793e6d2dcbdebcf34
TLSH
T118C02B0C63110304F1C88378114112C18A404200F0915F0102B2060C9636F003430C19
MD5 SHA1 SHA512 TLSH

Submit Download

2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-27_bf5018323127600ffbc8ead99fc285b0_amadey_darkgate_elex_emotet_icedid_nymaim_rhadamanthys_smoke-loader_stop.exe
Size 1.1MB
SHA256 3a5da9b3e0852cf55a76c7b767868fb99babdf7f8325ed14fa9613ad488c4b8b
MD5 bf5018323127600ffbc8ead99fc285b0
SHA1 219f40f6add237e238e195be0ea530b9b1504c94
SHA512 bbcaca6e61009d94ae56508845f22b15d45b730a60dea94ba200b0301e6b23f165cca2cc62726d178e0ccdf358078b088d91aad036d4e53fdb2c1534fdc3bd55
SSDEEP 12288:GaoVm94YoBGEtx0l874jrIWXg1MzBFnI8UChNXW5iuWXx:GDVm9cGUU4UBdI89hW5iuWXx
TLSH
T1D945190277E58179F1F37B71AEBA92645A77BCB09D36C50E27D1225E0970A80DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM32.exe

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM32.exe
Size 905KB
SHA256 98d9926152fda45705f5e208d7236e467caeef83d756a14b4104ebf804644b29
MD5 fe821f6fa60e9df9fdee69a23488bbab
SHA1 f6a5c0e05ab0b7ffa81a3637e4a4110458a38e1d
SHA512 22ffc710b73460f13a94d8ce9cdd1d455043610776972cc953d301b67a7b91465719d86ffcaa72c3ee85c30baa5c0abca364943ea1bcc87b097c4abd39bdc519
SSDEEP 6144:1G6lX2ih9UB9jxbu/l8wOUsn1yy5//+9ljrVQxWc4Jg1LozBFnI8f4rCE8shqppY:kBGEtx0l874jrIWXg1MzBFnI8UChNXWH
TLSH
T10315090277F98179F1F37B71AEB992645A77BCB09D35C10E26D1225E09B0A90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM32.exe

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM32.exe
Size 236KB
SHA256 6e038b4780f05af95c6edff37e2de6127857b49d7c6688aea833ef867023cf54
MD5 d112878b2b2c02ae85ea68eb9015e8dc
SHA1 d52f0e4bbd73933e23cff8692b94d89235d0774e
SHA512 b6503e8afee68387ba171c2a6b439cc18b5842c8d24a53e6e5cdf08228b192c6daa4430a1f997ecd8545f368d59fb8c0dc4740068c30c33e4888bdb50a8c37a4
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nhy0Z5XIYuQbiYV0OZNjrc1F+QUQoRlXzP:GjuDOhVLS5nhRnXIYViuW1FXEl
TLSH
T1C4349D1136D084B6E1A8113148B66F75C776FCB41A32D79BB760BB0A6E31B80C93776B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 166KB
SHA256 aa7589969f7ab2d949ca218f543877be72787f62a9de11b840854845a7d93c39
MD5 6b3fd0739c53406c69f7a3c600b85ccb
SHA1 49c7f1170c96090bc60779d291cd4cee5ed8e7cf
SHA512 d719f1e271c35161ac7391b7f5a329a962bf4024c5aafc647666e26d80d3569b88a48dee63e2f68ffbeb16abeb6dcb858a22da30578187369545f334b5e4e9cb
SSDEEP 3072:kT4CJ4QmKk61NmSTBjDT7lVKG+4MztutF4NVxcCXXYAFtPD:9xY8
TLSH
T186F3D44363FC1219F6F37F41AEB852A44B77BDA1AA3EC14D1685115E08F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmpA37A.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA37A.tmp
Size 152KB
SHA256 4e6ba427e0cf7124a8a88e3567297ccce6acc076ecf55f51412a097f2433053d
MD5 fdc67193384ef382c2d1697989846054
SHA1 e18227f7ab3d54078c38fd4810b21c03e9f17360
SHA512 a2a97cfadaffc2a63fe8fc2bd248b413dd9f1ea5cfded06eb7e2dacd1263a20b2800c279c9227f1aa01a6469046b7d462723b53f9bedf51072ae1992af3fe494
SSDEEP 3072:ul5DVnMvbOU6VAYD6eS91So1jaAMH5nhy0Z5XIYQQp:ujuDOhVLAo5nhRnXIY9
TLSH
T14FE36B0136C185BBE0B925314D766BA48BB5FCB52932C62FB7513B0E6E31780893777A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eventviewer.exe

Path C:\Windows\SysWOW64\eventviewer.exe
Size 88KB
SHA256 3baf58e8eb6f1dee7da7df83cb38925e69ffe130a02f667380cbee69aea17b15
MD5 188a727732ea436cedbfa4f016e7bbdf
SHA1 bf0ba32262cc4abb23e5c61ad6c750188558c8d1
SHA512 7139f3967289b66bb27bbd2b669ebe53197d3a825a21b8614e5352d426f3a74ba88d8618b869bb19d6c8a51780e636042c9a379f8d797d552cb316be1570e26b
SSDEEP 768:6hKzpWe7ofYFf0vX2Y9MMcz/pK3mriMYH/K0o+0pdE+7c/vm9Oacl1iB90/Va0DN:j1W9YV0OZMIljwiJ7c/EOaclRkQUQoR
TLSH
T11193AF2A39E044B2D688407151F56F39D33FE5741B11A6C3EB78EF682D21AA0D53B78B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syslog.exe

Path C:\Windows\SysWOW64\syslog.exe
Size 148KB
SHA256 e30a53b07c3301ffd8e3a529ce8b25346c2ad94d27fe78e2af1475f4d633bdff
MD5 4a2bb1a53cd896f27a3e102e546e8286
SHA1 f526c72dbf12cdb0052310f5f2d36b80eb7ad86d
SHA512 d5ab59e50129c9789ce72bccf8c99008325ab9ddfa57dca5c738badae20074c848d069cd052da1c4412e331925d14a4cca12bcae92162ae729bcf1bab9683373
SSDEEP 3072:Gl5DVnMvbOU6VAYD6eS91So1ja6H5nhy0Z5XIYuQB:GjuDOhVLS5nhRnXIY7
TLSH
T100E35A0176D185BBE0B926314C766B648BB5FCB42932C61FB3523B0E6E35780893777A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download