4560ddf9175cc09db8cce24f152c614e5f8a31a6f067fc431f76d12270adc78d

Analysis

max time kernel
149s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/10/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe
Size 1.8MB
Sample261013-2pacdadf25
SHA256 4560ddf9175cc09db8cce24f152c614e5f8a31a6f067fc431f76d12270adc78d
MD5 b1b34c4baeeb91f4bf5f3b7d0e103583
SHA1 51279e9b5a4800b9aa37ab7effff511b8996797c
SHA512 d45b46fc969976f832edc9ad9e2614d26342d3201694c583f8e7df706dc4e19b7e04a49ded5eac981b67d780e8294320faa3c1be153dd8cb497be0f87f269d7d
SSDEEP 49152:9wzgdWd5K1GWmFiBPaQagw/oYg7q92qDogKMJKdD6PdDPyH4nwKw54:9yJ5K1GWmYBHagPYg7y2EogKMJKdGK4K
TLSH
T15D85AF313690D4B7C2733130855DA77AB6EDAA3069B8128722902F3D3E755D3992CB6F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
888	2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe
888	2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-12_b1b34c4baeeb91f4bf5f3b7d0e103583_amadey_darkgate_elex_mafia_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tranceiver.ini

Path C:\Users\Admin\AppData\Local\Temp\Tranceiver.ini
Size 92B
SHA256 dc3ba3af34e76e7661a8e207c78d62234504c29f173b2d63f8070521ca11fa3d
MD5 b5147c3dc02abca47328215fbf5e8d1f
SHA1 b5f67be02c75791222e31315c29be406572f674b
SHA512 1606cb0b7bca0945ce85f1ab27f98d65bceaba221acb62f8af3dc4628c76262a4f267a2af95e7ac6837416430c70d908d17326f9d3b43d01f825960ef39daf2c
TLSH
T145B012C2315089E988154116501435C015D89D39850C5C011B172C65DCC168423EAC64
MD5 SHA1 SHA512 TLSH

Submit Download