fa572aaf0f3fd4753fb75629c0e8845aa404bb682b8410885cfd563b995e3da8

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_a446918638deec03cb513c4f005aae5f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar.exe
Size 4.2MB
Sample260808-a8khxawgrc
SHA256 fa572aaf0f3fd4753fb75629c0e8845aa404bb682b8410885cfd563b995e3da8
MD5 a446918638deec03cb513c4f005aae5f
SHA1 b2613a0492c94f0cda0cc5f968060e4a1ced93ae
SHA512 506fbba667491c86e259698c2d2c07b7ca3a28fdcde8214fbd497e575a785825e29c1fa0ba95d9734b090eb49d6712fd81ae5126c4ee3c579fcba98c153443e5
SSDEEP 98304:vstsF7IabjKoh9WyV2Vlx/hv7St0OgO5v:kmFlV2VnpvUuO5v
TLSH
T15C167D216BF48135E177A6B5A9BAC366E9717C604B7086CF63407B3D1F329D09A72323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_a446918638deec03cb513c4f005aae5f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_a446918638deec03cb513c4f005aae5f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_a446918638deec03cb513c4f005aae5f_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop_vidar.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3124-0-0x000000002FC01000-0x000000002FC02000-memory.dmp

Download