cee602856cbd0eaefbd0e0b5d0c8b2e43d10272a954853b1c610d6e707fc6870

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_6ee2e416e9cf374b1b45aa2d0c046be4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 894KB
Sample260908-3en88aaa54
SHA256 cee602856cbd0eaefbd0e0b5d0c8b2e43d10272a954853b1c610d6e707fc6870
MD5 6ee2e416e9cf374b1b45aa2d0c046be4
SHA1 458e54de94d7665f8a76273b1f35a47e8965976d
SHA512 97ebfffeb91607d06bcba8d2fbeec719163dd774c94f1a99f11decb244cadc4be06bef06605adce2e252c8eb03ea5832798f44aa4535e400b5e6104c95056262
SSDEEP 24576:7ohkCJX+/aHsK+fM2jEaNZBqoeW7V6tGLfHtqls+0:7omCF+/ksDM2jh3BqS7YtGL/Als
TLSH
T11715E11137D5C076C26334375A56E3B965AEBC308E2143477BD03B7DAE34AE2DA2835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_6ee2e416e9cf374b1b45aa2d0c046be4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4788	2026-09-07_6ee2e416e9cf374b1b45aa2d0c046be4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-07_6ee2e416e9cf374b1b45aa2d0c046be4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_6ee2e416e9cf374b1b45aa2d0c046be4_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4788-0-0x0000000000400000-0x00000000004E7000-memory.dmp

Download

memory/4788-1-0x0000000000400000-0x00000000004E7000-memory.dmp