Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe
- Size 3.5MB
- Sample260711-e5s34abw8r
- SHA256 a31da8e528a487898c4c68624d3910ebe708479e2dc0f007e5d5e415187eff76
- MD5 6ad222606587a6b9c6ccf90239c4ff56
- SHA1 a6c5a4a543c51daf7087fc0899b66cd8a38292e9
- SHA512 ff94bb4cbc43f64f2104b493e5b082505cf8dd97b8b73285d642a98eaa625b2fdf12adf0d06356ade07613323197e1413d84a9d923fe684d2993eaae011a6f0d
- SSDEEP 98304:tJRtTe7+4UTi2zgjxdQgkvwNTbZfznmbpqD17GW65AKCSg:tjtTef9bNhzipqD1756CT
- TLSH T10FF5D022B751A0BFC22655328A68E379F3AEB970DB32028736187E3DD9714D35D1874B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe 2712 2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_6ad222606587a6b9c6ccf90239c4ff56_darkgate_elex_mafia_sakula.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Game.exe
- Size 5.3MB
- SHA256 ea153046166a0dd556ec4920304c204031dbf989e496c25678c26caaf12c8f32
- MD5 f0cdecd12bd814211a4acfadefe63ba5
- SHA1 c67d6e3afb65d6d5f24dfb86ceb6d6640f89831f
- SHA512 9eb5dd5f65d53f43a51ff1ec6251f1b87926824a9ed83c531aa6050dcefb6996c3f1836d41b8cae1412287fdde6c81dd247446aea5a93a4f3014832d4a17fb9e
- SSDEEP 98304:q7xfpd/B84OKWC28HtNLUbXlSo9VZIwqt:KfldgCQb1So9D1qt
- TLSH T1EB467C41E6525031D68770B0B5AD7B6FC83D99A41F2821D3EBF42E989DB01E1B9F3227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\client_trace.ini
- Size 319B
- SHA256 a580730c7e994ed573063c3a38a246e0295217f2cb10e196bc32fe518ebcf719
- MD5 9eb559c7a6dc5c4fbdbbd12515ab539c
- SHA1 70ea64d766ebaff0dd0546897138814feb1514db
- SHA512 b6d3b2b12908ed3b197c11ed93351b9439aef718cb528d294d2da6df0acb4883eb240eec0aa79ee086611ff364d498db44f62d55ca2e3f2182876ff264f3c72f
- TLSH T19EE08C3640643A192D68C0B94369CE59C3E0625A4CC176761A2D4A7C264F1EE16EFC78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\data\Npc\NPC26.DTA
- Size 1KB
- SHA256 eaeb4a42fc3ed11d601d4643983832c2f23ae7303fbc3f0035596f42e1897d64
- MD5 1e6fef17116b69f4ac313425a81f3494
- SHA1 4d2dc9c9528bdaa20b67a27273fe48cd3e9299fb
- SHA512 709cf77c003f7b085e934f6ff810f078d83c1fd465408f62aa206b5eb7ad19d6401431409e1b21ad34b4c3d29ef82d663fd805d63c410230d46c24d7d97b216f
- TLSH T1B52184394F13BC16C1E4FF39EB9E5BF478C4DB1AC7C5A9408A6843C89E80A2B4359802
- MD5 SHA1 SHA512 TLSH