01a16a3c800c1ba4b126089dd173553a173983f648b743728073dcad1890f878

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 18:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe
Size 3.7MB
Sample260715-w2l9tabw2n
SHA256 01a16a3c800c1ba4b126089dd173553a173983f648b743728073dcad1890f878
MD5 9db27da0c3d8474bb3429eb4a0357142
SHA1 6c6806e4c8987ce9c54aa184fae318931b4d7335
SHA512 64a7977a542c1a4e05e7ac5dabcf712dceb1d88c3bf1b0face9fc90f8aeaed1cc6902480ff537b74487dc1e0f1ff4de30dd5d7ff4df6ca0491b9d7cf565a4595
SSDEEP 49152:Qoa1taC070dosDMsN//h5iAOYI1YBado8NdO37eXUeESgyAxnFQ+pjeESgyAxnFE:Qoa1taC0fOjDoo8NdOLlGcVpjGcVp
TLSH
T11806BE1233F84A2AF0BF07BD793967904AFDF9612AA1DB1F19A066ED0C637418D51327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4120	41D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	41D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4120	1772	2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\41D.tmp
  "C:\Users\Admin\AppData\Local\Temp\41D.tmp" --splashC:\Users\Admin\AppData\Local\Temp\2026-07-15_9db27da0c3d8474bb3429eb4a0357142_amadey_darkgate_elex_smoke-loader.exe F8EA3F80376F91D96D4FA4C5218FD607C252C4D376CDAC80764530746E8A6D0DA0A97DF655D0D40509E38CFB7F1409B36C51BB7F775C8B8F67449EEB4886D78F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

41D.tmp

Path C:\Users\Admin\AppData\Local\Temp\41D.tmp
Size 3.7MB
SHA256 5920d516d4c189254a6b3e786d7bf1de032d780bd66c32bed82970c1695a2194
MD5 0062bf281daf95e1952d914a4f014f78
SHA1 2e41b7b5a544e472dfaadd7f09ea4559c039a973
SHA512 396347b858ac2456f9b575b9eb57cb5ace347636e19c2241617cc581fe893dc0df65d79e467d4e6bb9c6e7608e1d0a8eb74d1e8e7e6cb3401cccd18412329883
SSDEEP 49152:Qoa1taC070dWPjUMRgBJUTiTTJ8bFT3T3rcSeESgyAxnFQ+pjeESgyAxnFQ+p/iX:Qoa1taC0nRgHMiTTibFDkSGcVpjGcVp
TLSH
T12706AE1233F84A2AF0BF07BD793967904AFDF9612AA1DB1F19A066DD0C63B418D51327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/4120-6-0x0000000000400000-0x00000000005E6000-memory.dmp