2fef2758a6c98690d2d8f10d565a00d147224275d6e86e86a1f889e16ead7b4f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 1.5MB
Sample261017-e763qswzfv
SHA256 2fef2758a6c98690d2d8f10d565a00d147224275d6e86e86a1f889e16ead7b4f
MD5 e34e4cb189e964fb1f9987a66a890f07
SHA1 98250f18f95434d370aa64a7d7069098d474883c
SHA512 95da1cde68968b4c00a10b40f15528b8816d86f79ff6d560d3b61da977b9bf8569bc8b3558bb4518d41ce9401a9a29196e762cc14a7d8c1d00c7de0c0bc5d666
SSDEEP 24576:bfU6etouiRtgnDmK1+ptLD/nDtBHD8RFlSSN94AMdTEvcQFuOjOP95Xdt5c:bfU6eDgbPDLtB8RFQi95MdTAcQQfjP+
TLSH
T12C75BEE06690D827E463E6B3B93D843D9439AF631B2080CF66D47D791B75AC27A34E13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\FILE:	2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\PORTPROMPT:	2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3564	2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3564	2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-16_e34e4cb189e964fb1f9987a66a890f07_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

deviceop.txt

Path C:\ProgramData\Epson\Setup\deviceop.txt
Size 11KB
SHA256 4782fc6efe4c0ca4bcee121619064486686f87a1cab4ad1f08222d9fbc70624f
MD5 f5e7f5c85ea53ec45996af2dd3e60861
SHA1 190addf6b08f2857cdf841e661d5d09b0fd2a289
SHA512 c19cebfa86ce27af7e3ccd7eaba844cd1903d4cc8a46e74a14869a062b1f34bd69527eea738922a32114532b2116e794921fbc1c3123c2c36d39566f446ba833
SSDEEP 96:RTawkqUMzVsEizG42ZXG42jMG42jTG42joG42jPG42jyG42FLG42FVG42F9G42PS:RmFMzVsEiW1Y
TLSH
T12842A21557FA869AF0F3D643C1FBA0A36537BD996238DE0D05C263B969B2500A9C0F1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download