Analysis
- max time kernel
148s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/07/2026, 13:58
General
- Target 2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 12.4MB
- Sample260703-q97b3aav21
- SHA256 60826923870a073d4aecf69aead8676b5dab1eab3dabcd8578dc5130fbbf6a7b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\act16BF.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\act16BF.tmp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Elevated.exe
Report.exe
ScreenExp.exe
Viewer.exe
Setup.cjstyles
Setup.exe
Setup.xml
Setup0409.dll
home_config_en.cab
home_core.cab
home_english.cab
home_setup.cab
home_ui.cab
mfc.cab
runtime.cab
thirdparties.cab
xtreme.cab
memory/3956-80-0x0000000075680000-0x00000000756F4000-memory.dmp
memory/3956-71-0x00000000773D0000-0x0000000077983000-memory.dmp
memory/3956-70-0x00000000763F0000-0x00000000764D3000-memory.dmp
memory/3956-79-0x00000000773D0000-0x0000000077983000-memory.dmp
memory/3956-101-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-100-0x0000000075700000-0x0000000075910000-memory.dmp
memory/3956-99-0x0000000076F50000-0x0000000076FFF000-memory.dmp
memory/3956-96-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-95-0x0000000075700000-0x0000000075910000-memory.dmp
memory/3956-94-0x0000000076F50000-0x0000000076FFF000-memory.dmp
memory/3956-93-0x0000000076940000-0x0000000076965000-memory.dmp
memory/3956-92-0x0000000075680000-0x00000000756F4000-memory.dmp
memory/3956-91-0x00000000773D0000-0x0000000077983000-memory.dmp
memory/3956-90-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-89-0x0000000075700000-0x0000000075910000-memory.dmp
memory/3956-88-0x0000000076F50000-0x0000000076FFF000-memory.dmp
memory/3956-87-0x0000000075680000-0x00000000756F4000-memory.dmp
memory/3956-86-0x00000000773D0000-0x0000000077983000-memory.dmp
memory/3956-85-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-84-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-83-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-82-0x0000000075700000-0x0000000075910000-memory.dmp
memory/3956-81-0x0000000076F50000-0x0000000076FFF000-memory.dmp
memory/3956-51-0x0000000076940000-0x0000000076965000-memory.dmp
memory/3956-97-0x00000000773D0000-0x0000000077983000-memory.dmp
memory/3956-98-0x0000000075680000-0x00000000756F4000-memory.dmp
memory/3956-78-0x00000000763F0000-0x00000000764D3000-memory.dmp
memory/3956-77-0x0000000076860000-0x000000007693C000-memory.dmp
memory/3956-76-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-75-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-74-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-73-0x0000000075700000-0x0000000075910000-memory.dmp
memory/3956-72-0x0000000076F50000-0x0000000076FFF000-memory.dmp
memory/3956-65-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-69-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-68-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-67-0x00000000759B0000-0x00000000759C9000-memory.dmp
memory/3956-66-0x0000000076710000-0x0000000076830000-memory.dmp
memory/3956-64-0x0000000076940000-0x0000000076965000-memory.dmp
memory/3956-63-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-62-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-61-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-60-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-58-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-57-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-56-0x0000000076940000-0x0000000076965000-memory.dmp
memory/3956-55-0x0000000076A80000-0x0000000076AFA000-memory.dmp
memory/3956-54-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-50-0x0000000076A80000-0x0000000076AFA000-memory.dmp
memory/3956-49-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-46-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-45-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-44-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-40-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-38-0x0000000076A80000-0x0000000076AFA000-memory.dmp
memory/3956-47-0x0000000076A80000-0x0000000076AFA000-memory.dmp
memory/3956-48-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-52-0x0000000074870000-0x000000007489C000-memory.dmp
memory/3956-42-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-43-0x0000000076A80000-0x0000000076AFA000-memory.dmp
memory/3956-41-0x0000000023107000-0x0000000023108000-memory.dmp
memory/3956-39-0x00000000747F0000-0x000000007486A000-memory.dmp
memory/3956-37-0x0000000074E80000-0x00000000750D1000-memory.dmp
memory/3956-59-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-53-0x0000000022F30000-0x000000002321A000-memory.dmp
memory/3956-195-0x0000000023107000-0x0000000023108000-memory.dmp