07059b203552a711e78f3cf487943df8f95c37f14f024bbacb0fada5a7528519

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
Size 714KB
Sample260801-xe1pcsfb93
SHA256 07059b203552a711e78f3cf487943df8f95c37f14f024bbacb0fada5a7528519
MD5 f931e590e245a069a57a936e0e129102
SHA1 e8f68bb53fa6582c8c03f8d745eced97efab09a6
SHA512 bd4a3c218b7d69af2c4d41f854ae97abcee0582bacba9df1e8ca08908534cca65bd925358bf646d0bd8f96a342d45146e0311c2195a31121355520e9a476d642
SSDEEP 12288:mxGz3mDUXfy264kSxOxVOidVBRXjIjb6anfKjOEZ:m23HHkSxOZdrRfOWLZ
TLSH
T139F46D2237E4E032E2724B346F6BD2655676BC319870894FB7D43F3D2F706829A25B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit discovery persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\d:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\i:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\p:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\v:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\j:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\n:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\o:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\q:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\r:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\s:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\x:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\h:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\k:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\y:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\g:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\l:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\m:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\t:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\u:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\w:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
File opened (read-only)	\??\z:	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_f931e590e245a069a57a936e0e129102_amadey_darkgate_elex_glassworm_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
PID:4460