e9de07699d24c722f3d4733e3688cd8504a293602c34e6cd10382193fd74c567

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/11/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_d277960e6d3ebc1a7b9506dd631c8a76_amadey_darkgate_elex_floxif_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
Size 4.0MB
Sample261107-2eppbagt3l
SHA256 e9de07699d24c722f3d4733e3688cd8504a293602c34e6cd10382193fd74c567
MD5 d277960e6d3ebc1a7b9506dd631c8a76
SHA1 d54af0b73de960704fb38d4fef42508fd26e8a94
SHA512 f9b4a02919c1ab2b52e9c8f68a44b35cd399a0938e98100baaac1514785987d243002bbed963e32b215383fe423599f41f35673f5914ff1152105722af75a447
SSDEEP 49152:gQXflQUiXAU0s7N119aTMvq2wntQ6BE4KSiviv4KC:gClEuIN1vkf2EZiX
TLSH
T128168D13A6C3557AC0631A76983F671AAE2ABD12273894CB3BF47D0D1E757C1B538283
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_d277960e6d3ebc1a7b9506dd631c8a76_amadey_darkgate_elex_floxif_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-06_d277960e6d3ebc1a7b9506dd631c8a76_amadey_darkgate_elex_floxif_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_d277960e6d3ebc1a7b9506dd631c8a76_amadey_darkgate_elex_floxif_gcleaner_glassworm_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4740-0-0x0000000000400000-0x00000000007EC000-memory.dmp

Download

memory/4740-1-0x0000000000400000-0x00000000007EC000-memory.dmp