Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 07:33
Behavioral task
behavioral1
Sample
2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
- Size 10.8MB
- Sample260416-jdlxxsdv81
- SHA256 a0c3e28e4a138c21bbe1cbb1d2f22c3e2fcd7b1bf34902f8852ba381aa43dc12
- MD5 90aa52f6e3fac8941a87cafa3bc2ca39
- SHA1 22bc35255e217f8c744efcb28da8680799190f8a
- SHA512 7dad5367409e6b1e6a2da1c3eea4a7da20328e9c88164abe3551ad4fd6bb58198e82ba1df8bd5c5ff468ba531541a750490299713fe64b50b928443017b7e335
- SSDEEP 196608:NI1T+QoGYfScnQFNXG/UI1T+QoGYfScnQFNXG/I7q29/on9X5ITq41F+:QCQoGYfJQFNW5CQoGYfJQFNWg2nDIf+
- TLSH T1FEB69E12E2E840E1D567413C896AD716EBB8B8151B31DBCF11A4C6DE2FF3AD25E36321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral1/memory/4912-0-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral1/memory/4912-1-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral1/files/0x00010000000081ea-6.dat UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\tar.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\where.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\write.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe -
resource yara_rule behavioral1/memory/4912-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4912-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00010000000081ea-6.dat upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.1_none_2eeab9eac7c3eb5c\FXSCOVER.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpksetup.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15805.0_none_73cc8b3e43ba1056\aspnet_compiler.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\DWWIN.EXE 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1_none_fb337fa99fb8bc2f\BioIso.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.1_none_126d541494a0ae5b\CCG.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.264_none_098f3a6c3a48359d\r\printfilterpipelinesvc.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.19041.1_none_64d83b9e511c141f\SecEdit.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\MsSense.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_3fc8ddfd98ad3137\IEExec.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsirdpclient.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\aspnetca.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\f\UtcDecoderHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\WWAHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-daf-pospayments_31bf3856ad364e35_10.0.19041.1_none_0b83240c6bc26a13\pospaymentsworker.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\f\PinningConfirmationDialog.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\r\InputPersonalization.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\wow64_installutil_b03f5f7f11d50a3a_4.0.15805.0_none_004b4e08cd94c339\InstallUtil.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\f\conhost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\r\ImeBroker.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\wdagtool.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\f\notepad.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\r\ofdeploy.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\LaunchTM.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.19041.1237_none_d618a074f3588a53\bcdboot.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.746_none_b4017de081b11e02\MDEServer.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\doskey.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\SysResetErr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\f\runexehelper.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.19041.1_none_03029e85abc99279\bitsadmin.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\cleanmgr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\r\wecutil.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\tpmvscmgrsvr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\upnpcont.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\LaunchTM.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.84_none_9f3e49455f52d8f7\f\dxgiadaptercache.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\fhmanagew.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.19041.1_none_60ade0eff94c37fc\osk.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_25afcd12036f5605\RMActivate_ssp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\wmprph.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseCE.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\f\PnPUnattend.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\splwow64.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6267e352b86de969\setx.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\f\RuntimeBroker.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingShell.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\f\wecutil.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.1_none_1f070c37a19029ff\powershell.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.928_none_4621828876257e43\n\certreq.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4912
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 13.7MB
- SHA256 668df2a7059154d27c58529a7e0810eab64a2114349be244c32bcaa323839da1
- MD5 636c4550679eb99361b98e3dda6e3690
- SHA1 649918198de0e59f54aaca78c35252ace999dccc
- SHA512 50c5e942540a31842d21eabbce33aa4ae6fe2adc54c2f34ba2099fe242f7e5bf1b9f305e54aca36090f08c5381c87f67d3bec7489ccab62c414a64e27140d8cc
- SSDEEP 393216:QCQoGYfJQFNW5CQoGYfJQFNWg2nDIfpGi:hT+Tg2DIf
- TLSH T113E6AF12E2A840E1D167813C896AD613FAB47C195B31DACF11A4C6EE1FF7BD15E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH