Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 07:33
Behavioral task
behavioral1
Sample
2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
- Size 10.8MB
- Sample260416-jdlxxsdv81
- SHA256 a0c3e28e4a138c21bbe1cbb1d2f22c3e2fcd7b1bf34902f8852ba381aa43dc12
- MD5 90aa52f6e3fac8941a87cafa3bc2ca39
- SHA1 22bc35255e217f8c744efcb28da8680799190f8a
- SHA512 7dad5367409e6b1e6a2da1c3eea4a7da20328e9c88164abe3551ad4fd6bb58198e82ba1df8bd5c5ff468ba531541a750490299713fe64b50b928443017b7e335
- SSDEEP 196608:NI1T+QoGYfScnQFNXG/UI1T+QoGYfScnQFNXG/I7q29/on9X5ITq41F+:QCQoGYfJQFNW5CQoGYfJQFNWg2nDIf+
- TLSH T1FEB69E12E2E840E1D567413C896AD716EBB8B8151B31DBCF11A4C6DE2FF3AD25E36321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 3 IoCs
resource yara_rule behavioral2/memory/4932-0-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral2/memory/4932-1-0x0000000000400000-0x0000000000410000-memory.dmp UPX behavioral2/memory/4932-2-0x0000000000400000-0x0000000000410000-memory.dmp UPX - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe -
resource yara_rule behavioral2/memory/4932-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4932-1-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4932-2-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\wscript.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\f\mstsc.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.22000.318_none_701008567a383b30\f\AggregatorHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\sdchange.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\f\RecoveryDrive.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\f\RMActivate_isv.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_6ec3ffab3ec4b07b\f\LaunchWinApp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\f\ntoskrnl.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\f\TrustedInstaller.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.22000.41_none_705d08ab0a6355da\f\mspaint.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\msra.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpshell.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\f\MusNotifyIcon.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\f\MusNotification.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\explorer.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\f\msinfo32.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\bfsvc.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\f\net1.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\f\PktMon.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\f\Robocopy.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\f\GenValObj.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\ResetPluginHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.22000.434_none_ae734c6bf20696b6\f\djoin.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\f\PkgMgr.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpinit.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\f\ISM.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\f\Microsoft.AAD.BrokerPlugin.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\f\ShellExperienceHost.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\f\ksetup.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\f\nfsclnt.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\f\SystemSettingsBroker.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\f\SearchApp.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\HelpPane.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\hh.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\notepad.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\f\msconfig.exe 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5084 4932 WerFault.exe 78 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_90aa52f6e3fac8941a87cafa3bc2ca39_amadey_coinminer_darkgate_elex_emotet_luca-stealer_manus.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4932 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4932 -s 3162⤵
- Program crash
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4932 -ip 49321⤵PID:3332