Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
02/08/2026, 03:22
General
- Target 2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe
- Size 6.5MB
- Sample260802-dwwl7asvbx
- SHA256 18811c4f4c38f9459439de2ac7500914f7f986231db682217a0ff3878755b344
Malware Config
Signatures
- Detects executables packed with Enigma 3 IoCs
- Detects packed executables observed in Molerats 3 IoCs
- Loads dropped DLL 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb6F40.tmp
evb6F51.tmp
evb6F81.tmp
evb6FD0.tmp
evb6FE1.tmp
evb7011.tmp
evb7021.tmp
evb7022.tmp
evb7042.tmp
memory/1712-71-0x0000000002DD0000-0x0000000002E3B000-memory.dmp
memory/1712-9-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/1712-70-0x0000000002B60000-0x0000000002BBE000-memory.dmp
memory/1712-69-0x0000000002BC0000-0x0000000002DC4000-memory.dmp
memory/1712-65-0x0000000002DD0000-0x0000000002E3B000-memory.dmp
memory/1712-67-0x0000000002DD0000-0x0000000002E3B000-memory.dmp
memory/1712-62-0x0000000002B40000-0x0000000002B53000-memory.dmp
memory/1712-57-0x0000000002BC0000-0x0000000002DC4000-memory.dmp
memory/1712-54-0x0000000002BC0000-0x0000000002DC4000-memory.dmp
memory/1712-42-0x0000000002B40000-0x0000000002B53000-memory.dmp
memory/1712-49-0x0000000002B60000-0x0000000002BBE000-memory.dmp
memory/1712-47-0x0000000002B60000-0x0000000002BBE000-memory.dmp
memory/1712-43-0x0000000002B40000-0x0000000002B53000-memory.dmp
memory/1712-60-0x0000000000400000-0x000000000050F000-memory.dmp
memory/1712-32-0x00000000026A0000-0x00000000026CF000-memory.dmp
memory/1712-39-0x0000000062AA0000-0x0000000062AF4000-memory.dmp
memory/1712-35-0x0000000062AA0000-0x0000000062AF4000-memory.dmp
memory/1712-0-0x0000000000400000-0x000000000050F000-memory.dmp
memory/1712-31-0x0000000002650000-0x00000000026A0000-memory.dmp
memory/1712-28-0x00000000026A0000-0x00000000026CF000-memory.dmp
memory/1712-26-0x00000000026A0000-0x00000000026CF000-memory.dmp
memory/1712-15-0x0000000010000000-0x0000000010401000-memory.dmp
memory/1712-21-0x0000000002650000-0x00000000026A0000-memory.dmp
memory/1712-19-0x0000000002650000-0x00000000026A0000-memory.dmp
memory/1712-6-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/1712-2-0x0000000077BF2000-0x0000000077BF3000-memory.dmp
memory/1712-13-0x0000000010000000-0x0000000010401000-memory.dmp
memory/1712-3-0x0000000077BF3000-0x0000000077BF4000-memory.dmp
memory/1712-72-0x0000000010000000-0x0000000010401000-memory.dmp
memory/1712-73-0x0000000002BC0000-0x0000000002DC4000-memory.dmp
memory/1712-76-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/1712-74-0x0000000000400000-0x000000000050F000-memory.dmp
memory/1712-77-0x0000000002B40000-0x0000000002B53000-memory.dmp