0b68e20387fae05aff48e73f0f8f144e09d737fbccc4d2e548f615c84d5a4e03

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe
Size 4.8MB
Sample260820-217f9azzcv
SHA256 0b68e20387fae05aff48e73f0f8f144e09d737fbccc4d2e548f615c84d5a4e03
MD5 f59da3ddfc2bec3b9b5b6c8aa341486c
SHA1 a63b740f1a6741ef430d25bcf5f2822c4bd726e4
SHA512 3a14a0c3f283f5ea66ae1e7525b7729c5e2933a72d0c768e6071eee91d3e98ab3d57962bfd5bae0a155078492db4c1cb1ec000ad0c534bdd218e8e9b68eb0cf5
SSDEEP 98304:Ltr4t84tQSkY3LcKoYUSLpEPnd8cc2zKM0w14FaIjm/M:LtG84JkMILYUPfd8chWu1OI/M
TLSH
T1D636CF2072E4C232F2B317703A35D662AA7EBE94E538C51D3A56425D16F3B84D67CF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 5116	1032	2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\2026-08-20_f59da3ddfc2bec3b9b5b6c8aa341486c_amadey_darkgate_elex_smoke-loader_stop.exe
  -deleter
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ISPackFiles.ini

Path C:\Users\Admin\AppData\Local\Temp\ISPackFiles.ini
Size 773B
SHA256 8c414f27c91d0cb34b916925cffacbd21bc3a75705f5d4d4ddd11b2442cd723a
MD5 d91b8bc4f1ce4c7a7db7ef6d9f96615f
SHA1 942930b365640ead5eea98d27d22cc544cba875f
SHA512 03084291cebd6c0324f8392dfee1b733f019f8e4e29515c8e0ea7215a182193ce4c36d63eea25e26765f5b9d8a1e80e3b6674bbe952cde192536c1510abd1d35
TLSH
T12E016956E28ADBAE2818A0E705FA92FEE0710E096F4577318724D40C558AC0DFAC9783
MD5 SHA1 SHA512 TLSH

Submit Download