783635c9234d1ffd6284f64148399bbe8d192e2bd2e500c8b25381a9652c4cb8

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 317KB
Sample260906-x52pcafm8v
SHA256 783635c9234d1ffd6284f64148399bbe8d192e2bd2e500c8b25381a9652c4cb8
MD5 b864183e261563ebce86adc33d091224
SHA1 1e38c36fa07ae899ca0537cf08bd42dd33e110d2
SHA512 a41496233b800288c84675245434b95cd7d3dbee7c59b837ccd545def31d5f2ea856d2b4f83292da6639aa27d399e75a64c3348f66b8d7d91f4b1eec2f7fc6c4
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZG9:dMgZXNOUBXXRTOAz+G9
TLSH
T1C0647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1440	2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1440	1016	2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
  "C:\Users\Admin\AppData\Local\Temp\2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back

Path C:\Users\Admin\AppData\Local\Temp\2026-09-06_b864183e261563ebce86adc33d091224_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe.back
Size 317KB
SHA256 1797617b3004c486456ba886280d9b1cc8ba7501334fbaef214c02d8eacbd9e2
MD5 913df1470de9d13899495ac938e8bae5
SHA1 b0c35e0a919f668d02bc891570d63f9c1a9c8311
SHA512 aa42568aa4d33690ec1e0291b5b68469b49ee46dba3d3d9c3ff7b0bb5156ff5b58f7eaf87442da29e8f1a87c1bdb0fe831e9140952763105ef4758e2d3890549
SSDEEP 6144:dnMfIq+XLROUxHXGmUReIyZyCcgHuVzOaO+tZGv:dMgZXNOUBXXRTOAz+Gv
TLSH
T14E647B02A6718072DB6A073B0452E37646797E341355A6CBE7A43A3EDD312D3673B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download