Analysis
- max time kernel
148s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 02:38
Behavioral task
behavioral1
Sample
2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
- Size 1.7MB
- Sample261102-c44r4aev2z
- SHA256 21b31ae14921aa8327f2195dd80c04a2ed59834a0e8790a9a2cecce78536d83a
- MD5 f7a2f87c5484e6466b690fe5db0d2c7c
- SHA1 cc69f1b5caf78878a1ff0eefbaac54d1a98878dd
- SHA512 ec269ee33b35ded9cd43256d8a8d7bb31401fbe4a0c88cb6253da793dafea7783db3c5646bc8e23dc509e53462a0c1dd02b06633dcc809cc229d5c0377beead9
- SSDEEP 24576:dr0URPEJ0sg+9dqVkpSHeJUovM3yReRdqmCAzxj884:drxRP9sg+/qVks+JUTyMRYmJzxj8Z
- TLSH T131857D1277F95129F1F37BB1AEB883655A77BC71AE39C50E2280215E09B4B40DA72733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in System32 directory 20 IoCs
description ioc Process File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Program Files directory 19 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Temp 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\Backup 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5112 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5112 2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_f7a2f87c5484e6466b690fe5db0d2c7c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 90B
- SHA256 e5b7971c2d9be90ddeb2c3aea2e76ebe4cf709c2126d73331f7ab30c6438dd75
- MD5 229d1a549c4a97c1e5a14301a9af0ef7
- SHA1 1dda6754955e4302033fd00f589617be40183ac6
- SHA512 3e5354330c89b079725b055954190d7a35d487f1b4451d4ee1ac0afb22eaf6f50e13024e3d2f0875be180dcc3334236e286d1a39b6332ed6438fd7c383da2d2d
- TLSH T1B8B0110220C00802B8202F238FF800B0E20338C8880BC03E0088020F02C028AEA220B2
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Adobe\ARM\ArmReport.ini
- Size 782B
- SHA256 d07699f0b523af43c79955dcde796f50f6b2b9289772c4442f05d28d6e8b1866
- MD5 bce1e1c2b37b73deb297cfe4dbf2d0c1
- SHA1 518a3e71b8f11ac19dc9ffc1f18d1cdace958475
- SHA512 613113e8a7829106282c4e37f21fff99ee40be329af1f5d23ed77ff07a3d94059893443abf5a02ee1ec8c21c3b5379e4be1331d556d6c007c97ef3b18287b820
- TLSH T1A301BC831AE91120F1B21F44DFF9907357333CA35C2CC86C90D8420E89E1A80D5B2BBB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
- Size 185KB
- SHA256 fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e
- MD5 02a2c53bd88849d635e985274c7ca2ef
- SHA1 b229a28dfaf7fd1cd5fda4c9cab5828027d509ce
- SHA512 e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b
- SSDEEP 3072:hT4DJA0CXkQqSmSgojgTaDuK1+4xKtaU/Q+QPYtY7FMPFTMNropXY:SJYS0
- TLSH T19104D44363FC1209F6F37B41AEB852A44B77BDA1AE3EC15D1685015E48F0A90DA72B73
- MD5 SHA1 SHA512 SSDEEP TLSH