Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 03:22
General
- Target 2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe
- Size 6.5MB
- Sample260802-dwwl7asvbx
- SHA256 18811c4f4c38f9459439de2ac7500914f7f986231db682217a0ff3878755b344
Malware Config
Signatures
- Detects executables packed with Enigma 3 IoCs
- Detects packed executables observed in Molerats 3 IoCs
- Loads dropped DLL 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_309ecc0bab04f59f9c879009e547a6a7_darkgate_elex_gcleaner_helldown_poet-rat.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb7F0B.tmp
evb7F4A.tmp
evb8016.tmp
evb80B3.tmp
evb8131.tmp
evb81FE.tmp
evb822D.tmp
evb8319.tmp
evb8397.tmp
memory/6060-3-0x0000000077E49000-0x0000000077E4A000-memory.dmp
memory/6060-24-0x00000000026D0000-0x0000000002720000-memory.dmp
memory/6060-6-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/6060-21-0x00000000026D0000-0x0000000002720000-memory.dmp
memory/6060-29-0x0000000002720000-0x000000000274F000-memory.dmp
memory/6060-31-0x0000000002720000-0x000000000274F000-memory.dmp
memory/6060-27-0x0000000002720000-0x000000000274F000-memory.dmp
memory/6060-19-0x00000000026D0000-0x0000000002720000-memory.dmp
memory/6060-2-0x0000000077E48000-0x0000000077E49000-memory.dmp
memory/6060-38-0x0000000062AA0000-0x0000000062AF4000-memory.dmp
memory/6060-35-0x0000000062AA0000-0x0000000062AF4000-memory.dmp
memory/6060-43-0x0000000002CC0000-0x0000000002CD3000-memory.dmp
memory/6060-45-0x0000000002CC0000-0x0000000002CD3000-memory.dmp
memory/6060-0-0x0000000000400000-0x000000000050F000-memory.dmp
memory/6060-48-0x0000000002CE0000-0x0000000002D3E000-memory.dmp
memory/6060-42-0x0000000002CC0000-0x0000000002CD3000-memory.dmp
memory/6060-49-0x0000000002CE0000-0x0000000002D3E000-memory.dmp
memory/6060-12-0x0000000010000000-0x0000000010401000-memory.dmp
memory/6060-73-0x00000000026D0000-0x0000000002720000-memory.dmp
memory/6060-51-0x0000000002CE0000-0x0000000002D3E000-memory.dmp
memory/6060-56-0x0000000000400000-0x000000000050F000-memory.dmp
memory/6060-63-0x0000000002D40000-0x0000000002F44000-memory.dmp
memory/6060-60-0x0000000002D40000-0x0000000002F44000-memory.dmp
memory/6060-69-0x0000000002F50000-0x0000000002FBB000-memory.dmp
memory/6060-71-0x0000000002F50000-0x0000000002FBB000-memory.dmp
memory/6060-67-0x0000000002F50000-0x0000000002FBB000-memory.dmp
memory/6060-13-0x0000000010000000-0x0000000010401000-memory.dmp
memory/6060-72-0x0000000010000000-0x0000000010401000-memory.dmp
memory/6060-9-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/6060-74-0x0000000062AA0000-0x0000000062AF4000-memory.dmp
memory/6060-75-0x0000000002CC0000-0x0000000002CD3000-memory.dmp
memory/6060-82-0x0000000002F50000-0x0000000002FBB000-memory.dmp
memory/6060-81-0x0000000002D40000-0x0000000002F44000-memory.dmp
memory/6060-80-0x0000000002CE0000-0x0000000002D3E000-memory.dmp
memory/6060-79-0x000000005A4C0000-0x000000005A4D3000-memory.dmp
memory/6060-78-0x0000000000400000-0x000000000050F000-memory.dmp