c758e743f188975e0be0b96613020e4c51faede4bd5c56d782756e463e41848b

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 20:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe
Size 2.1MB
Sample260727-ysb4lada39
SHA256 c758e743f188975e0be0b96613020e4c51faede4bd5c56d782756e463e41848b
MD5 7e3e05d1a9421dc22c629eada7b5462d
SHA1 03d59774063a8b7e42f74297ed703a904c59b2c6
SHA512 f441458e1faa13fc82980249e49ae70360ca1c157e45d456452f586b9b9b71a0398196b805e70748d0f00eb0090d4e81a5c43d0c387fdfbe442b47c64baaf920
SSDEEP 49152:j2aoHmxkyh93kxdgqMs4lQMEf5uBiIpk3bh3K7Y2n9ewF2UJFNDh2se3:4HmxkMkIqqlQMEfYBiIpkrqn9ea2UJFe
TLSH
T1D0A5BF723A91803BD17B3230824EE3F9A3B9A9704D76524766909F3D2F354529A2D37F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2696	2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2696	2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe
2696	2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe
2696	2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_7e3e05d1a9421dc22c629eada7b5462d_amadey_darkgate_elex_smoke-loader.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DeviceUsb.dll

Path C:\Users\Admin\AppData\Local\Temp\DeviceUsb.dll
Size 8KB
SHA256 fad660bc7e006c58f37db9d75b72bf30c089ef62fc4e72673cbfd424d247b5e5
MD5 4af659cb04807c2015339d8ba0ed4fc6
SHA1 02316dc51ce2d959c12fd370529a31fdc0535932
SHA512 aa92fcb39cd85702d52044ab6cc9bcdb35ff372c9e620c8a16201ee5c30d5d4235a213a34043fcf538e973b32d04278ea7410ee1c0a3a88e0ba13cd34310d151
SSDEEP 192:MSmqiJy0qZnpFoT6i7wi9IacPIx+xO3X+cqZVN6GW:OhMOP7j9Iacc+QuvW
TLSH
T144022B3DEA834063EA0C06F66D9762764B7D121733D230FBB760549A1ED06D1F8B063A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download