Analysis
- max time kernel
149s - max time network
31s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 13:58
General
- Target 2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 12.4MB
- Sample260703-q97b3aav21
- SHA256 60826923870a073d4aecf69aead8676b5dab1eab3dabcd8578dc5130fbbf6a7b
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 6 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_a351daf5d897e685d16c17a0edba4e38_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\actFF99.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\actFF99.tmp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Config.xml
Elevated.exe
Report.exe
ScreenExp.exe
Viewer.exe
Setup.cjstyles
Setup.exe
Setup.xml
Setup0409.dll
home_config_en.cab
home_core.cab
home_english.cab
home_setup.cab
home_ui.cab
mfc.cab
runtime.cab
thirdparties.cab
xtreme.cab
memory/5436-73-0x0000000074FB0000-0x0000000075092000-memory.dmp
memory/5436-50-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-105-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-104-0x0000000074240000-0x0000000074265000-memory.dmp
memory/5436-103-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-100-0x0000000074FB0000-0x0000000075092000-memory.dmp
memory/5436-97-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-96-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-93-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-89-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-88-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-85-0x0000000074BE0000-0x0000000074E07000-memory.dmp
memory/5436-84-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-81-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-80-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-78-0x0000000074BE0000-0x0000000074E07000-memory.dmp
memory/5436-75-0x0000000076930000-0x0000000076F0C000-memory.dmp
memory/5436-74-0x0000000075A00000-0x0000000075B55000-memory.dmp
memory/5436-72-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-69-0x0000000074BE0000-0x0000000074E07000-memory.dmp
memory/5436-67-0x0000000076930000-0x0000000076F0C000-memory.dmp
memory/5436-79-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-77-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-76-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-108-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-71-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-70-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-68-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-65-0x0000000075A00000-0x0000000075B55000-memory.dmp
memory/5436-64-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-57-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-55-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-54-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-107-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-44-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-40-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-66-0x0000000022E27000-0x0000000022E28000-memory.dmp
memory/5436-63-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-62-0x0000000074F90000-0x0000000074FAB000-memory.dmp
memory/5436-39-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-59-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-56-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-47-0x00000000756B0000-0x000000007572E000-memory.dmp
memory/5436-51-0x00000000756B0000-0x000000007572E000-memory.dmp
memory/5436-49-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-48-0x0000000076790000-0x00000000767B5000-memory.dmp
memory/5436-46-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-45-0x00000000756B0000-0x000000007572E000-memory.dmp
memory/5436-43-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-41-0x00000000756B0000-0x000000007572E000-memory.dmp
memory/5436-42-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-38-0x00000000756B0000-0x000000007572E000-memory.dmp
memory/5436-53-0x0000000073C50000-0x0000000073C7E000-memory.dmp
memory/5436-128-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-112-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-116-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-120-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-94-0x0000000075FC0000-0x0000000076071000-memory.dmp
memory/5436-126-0x0000000073BD0000-0x0000000073C4D000-memory.dmp
memory/5436-86-0x0000000022C50000-0x0000000022F3A000-memory.dmp
memory/5436-83-0x0000000074B50000-0x0000000074BD1000-memory.dmp
memory/5436-61-0x0000000076220000-0x0000000076330000-memory.dmp
memory/5436-60-0x00000000750A0000-0x0000000075125000-memory.dmp
memory/5436-58-0x0000000076790000-0x00000000767B5000-memory.dmp
memory/5436-52-0x0000000076790000-0x00000000767B5000-memory.dmp
memory/5436-188-0x0000000022E27000-0x0000000022E28000-memory.dmp