Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 04:04
Behavioral task
behavioral1
Sample
2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
- Size 13.7MB
- Sample260420-emywmacv5s
- SHA256 a758f88527899ba83bcb2e60dd73c7f2f7036475bd1524122dab41191e924d88
- MD5 2f34af36169c59a52c33a7ae96c5328c
- SHA1 d54befb7c0940737648ea4853312d6a3de7ddce6
- SHA512 0ee27f6665a96b505544e93d9fb691f2ac4a633656f0310eab7d66fbbfae68eab56223b107e1fef4bdafa2e36ac39fe00f6b56f6d0630e4dc8fe01d892a34505
- SSDEEP 98304:fMsYok7VfTqnstLElgxC9Y5lpuG8rhv7StZ6YUbYZfgs0QlxJjos:MoWTqnhNQIG8dvUJU64sNos
- TLSH T107E63B02B6B4D972F07EB4F0D8A4C6699D797C504E73A95B3270FB9E6E335905A20332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\logman.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\winrs.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\setx.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe -
resource yara_rule behavioral2/memory/5944-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000900000002ab70-5.dat upx behavioral2/memory/5944-598-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5944-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\f\MusNotificationUx.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.22000.1_none_fe52560879e25943\RpcPing.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.22000.1_none_d8155ee7186af991\TpmInit.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_7918a9fd73257276\f\LaunchWinApp.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\f\appidtel.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\splwow64.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.22000.1_none_7b4d59f26b91a73c\sdclt.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\f\wowreg32.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\r\wmpconfig.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\r\wpnpinst.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\r\tar.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.22000.1_none_3d7fbabd1601d8b8\cmdkey.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.22000.1_none_2790769f75be6dd7\DismHost.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchIndexer.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.22000.1_none_9582d7fd0fc1e753\dllhost.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_aae08517a75cb984\aspnet_regsql.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\audiodg.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.22000.1_none_e64ff994c88b8371\IMESEARCH.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\wsmprovhost.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\f\mstsc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\r\FilePicker.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\r\lpremove.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\net1.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_4a72530ae0a1ba07\regedit.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.22000.1_none_52f20556dd84fc53\charmap.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..-diagnosticsmanaged_31bf3856ad364e35_10.0.22000.1_none_c52a6f9591cae974\stordiag.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\ResetEngine.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCncProxy.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_636efb509c9a3cee\certreq.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-daf-pospayments_31bf3856ad364e35_10.0.22000.1_none_abd5b42ed12df708\pospaymentsworker.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.22000.1_none_10872c88a98c0f77\tsprof.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\ROUTE.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_c21dddd4c8838023\netiougc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.22000.1_none_16b2561948e7dd92\ieinstal.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\f\msinfo32.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6180ec8e85a3740e\imjpuexc.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.318_none_b139c7be49b8cbb9\r\FsIso.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\r\SystemSettings.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.22000.1_none_f7606706a9708e33\wslconfig.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.22000.1_none_bfc4aabf015b7a53\SyncHost.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_a8651901944b2dc3\TiFileFetcher.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15806.0_none_c8fad3ab465564d6\aspnet_regiis.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.22000.1_none_b3f4d8a73698f60a\vmplatformca.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.22000.1_none_141cd469f7aeedb6\cttune.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_09c9ecffc9049dc0\PATHPING.EXE- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.1_none_70fb0683c48edf32\WmiPrvSE.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_165d5ffaf262c602\MuiUnattend.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.22000.1_none_02ba73751dd9765e\setx.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\fixmapi.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_c87c050022130145\userinit.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\bfsvc.exe 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.22000.1_none_4e4c1e255ad155f3\lodctr.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.22000.1_none_5026ccd428229c6c\wlanext.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.22000.1_none_0e0860b6be3fb3ea\wmpnscfg.exe- 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_2f34af36169c59a52c33a7ae96c5328c_amadey_darkgate_elex_glassworm_icedid_luca-stealer_njrat.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.2MB
- SHA256 bb016aaebfb01764d47978a50639285374b93444bbbf6ff4111c2fdf5b0abdae
- MD5 befe03d01ba51fc5897f2f4dc17d148e
- SHA1 dcade7ddee5c0ca1c385482a36c37d9078af79c4
- SHA512 c84cad3a6ff25e5fbaca987c9a1be1034a3d92e271b817eb8026bc450b99ccc6427cf3b23a2365f12fa8f96932ad0efece68347bc296ebddaf9655f907173dbe
- SSDEEP 98304:fMsYok7VfTqnstLElgxC9Y5lpuG8rhv7StZ6YUbYZfgs0QlxJjoMjoL:MoWTqnhNQIG8dvUJU64sNoGoL
- TLSH T18BE63A02B6B4D972F07EB0F0D8A48669DD797C504E73A99B3271FB6D6E335905A20332
- MD5 SHA1 SHA512 SSDEEP TLSH