4bc9d4958ecf34d1ba32dde66b00d70380568de8f5ebb97990ae0997ee6c4f1f

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 317KB
Sample260806-2ngp3asbqa
SHA256 4bc9d4958ecf34d1ba32dde66b00d70380568de8f5ebb97990ae0997ee6c4f1f
MD5 b1a0e05edfa90ace42b2f53a487bc47d
SHA1 990d9876a2cb2691b1ebc7104da7874a7e728553
SHA512 d2d7d1dd132b916e4f667fb6672bcf62e051694ad081c4b57efd7593d5473fb8ac6d4d820605ee94d31b340c09d4855fb2c79b458098c251c209260af97abada
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGN:dMgZXNOUBXXRTOAz+GN
TLSH
T174647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5644	2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 5644	1096	2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-08-06_b1a0e05edfa90ace42b2f53a487bc47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 317KB
SHA256 00027fe99f9fd7eaac6b47f11eddc458e4c5b9c68d4c43ea6cbb2f97d6275456
MD5 cc4ce6cc94564149326edd97dfad419f
SHA1 bb933df99fdaa6f251a4f91da909b1f83a4f5f5d
SHA512 df9710186d1192eeab12ec6f7e3aa5835eb2e36183a7b5b7a026fd4c2b365609b72f24259421d67b4cc1c07162f4f4c570e05f3c346287ba2b971bd0529a35c5
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGg:dMgZXNOUBXXRTOAz+Gg
TLSH
T168647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download