Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 13:51
Behavioral task
behavioral1
Sample
2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 2.1MB
- Sample260416-q573sshv5l
- SHA256 fa5a23177fc612095f603a975ce810d86f4094a8cf6cafdccb0cd7415360b997
- MD5 21339c50080d78a175b0ad94b40bde26
- SHA1 0f4993809a6294ca6fdf71f1619221b796b663bd
- SHA512 7139e581b471ff72bdb4057bb4bd86385748b81eb0e488959e06ca087a5307788aa0c4c50fb6de28b0c212c964113c43276bf143f1f0d6ae2a89d00780084b58
- SSDEEP 24576:1IrBCvqVYAvnPjO7KX53RTh0tFda3nHQy5Sk2Z+ZO:fkYwnrOO53RTqtiT92wO
- TLSH T154A56B036E4D9B72C65F3E304C51D3E816247F1089137D6A2EC4BE9DEBB29C97A2D225
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chcp.com 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/4680-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001000000002a117-5.dat upx behavioral2/memory/4680-1288-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4680-3188-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E2505FBD-4E5B-4F5E-BD9E-BA50A6579E34}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\7-Zip\7zG.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpinit.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.22000.1_none_a1987ac693cecbd1\wbadmin.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\iisreset.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.22000.1_none_f6192218a034a3b9\wuapihost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCopyAccelerator.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.22000.1_none_d0ba8259b7939cb1\NetCfgNotifyObjectHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\msra.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\f\RdpSaUacHelper.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.22000.1_none_035a1d00a9e1b6ab\cipher.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_f8757a3e115338fd\Microsoft.ECApp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.22000.1_none_dc56eb74b96412e2\recover.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\smartscreen.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\chgusr.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_0ca953877ffcac58\waitfor.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\r\fontdrvhost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.22000.1_none_c3646c52777cf90a\OpenWith.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.258_none_dfe62f4e03f8472a\f\LsaIso.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\f\CustomShellHost.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\r\mstsc.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_49da5498936ff387\CertEnrollCtrl.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15806.0_none_cd062650b14ec503\ServiceModelReg.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\UevAgentPolicyGenerator.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.22000.434_none_4634d5a384238dfd\dsmgmt.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.22000.1_none_bbcd41b69cc34513\diskraid.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\RMActivate_ssp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\typeperf.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\instnm.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\poqexec.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\ldp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.1_none_1788ef5112142c1f\DeviceEnroller.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\r\eshell.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpresult.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\vfpctrl.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.22000.1_none_b90ac474910a4673\expand.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.22000.1_none_c5e1ff5406d59ba1\DevicePairingWizard.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_d7d3a12b5c67df85\r\iexplore.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\wpnpinst.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\SystemSettings.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\spoolsv.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..appserver-licensing_31bf3856ad364e35_10.0.22000.1_none_fcf9b91a40267bf0\tlsbln.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseSampleUploader.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_b2ca9978aba0e546\net.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\r\SearchApp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\r\nltest.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseCE.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.22000.1_none_795ac390c0ee4b33\chkntfs.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_615eec7b6e862785\comp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_6ec3ffab3ec4b07b\f\LaunchWinApp.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\f\CapturePicker.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.22000.1_none_0290e7ede64d11aa\PasswordOnWakeSettingFlyout.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.22000.1_none_132662a9c55e557b\attrib.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_6dc3a5a2d0fafee9\f\certreq.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_383fdbeacdabdb26\tcmsetup.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\Setup.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-bootenvironment-pxe_31bf3856ad364e35_10.0.22000.434_none_8c92a0565e9eec19\f\bootmgr.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVShNotify.exe- 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_21339c50080d78a175b0ad94b40bde26_darkgate_elex_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.6MB
- SHA256 0d03af7a704a7508f8f85749a0a1ab0dbe16cb00b3f43098f4ddfd35aeaf9273
- MD5 14f1ee12574309c64c98866281a4e5b9
- SHA1 42eed331dd5dedffd90df3a127dcfd91c5107cb5
- SHA512 a60d525d966cf449d9c7adcd3c3f00f03f00cbe2550e6f441d351bbb3a5598228d97109bddc93fc2608c199450d8be2fe405d3c1871ede88269f1f0bd7e7a88f
- SSDEEP 24576:1IrBCvqVYAvnPjO7KX53RTh0tFda3nHQy5Sk2Z+ZE0Le5ji0hmxNrMz:fkYwnrOO53RTqtiT92wEPji0Aj+
- TLSH T12DC581036D5C8B31C25F7E708C91D3D995207E008A237DA72EC5BE9DEBB29D9762D221
- MD5 SHA1 SHA512 SSDEEP TLSH