Analysis
- max time kernel
150s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
20/04/2026, 05:48
Behavioral task
behavioral1
Sample
2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
- Size 10.5MB
- Sample260420-ghrmvsat8j
- SHA256 e31f52312385799ec7edc53b433ac51df2e45fc2f5f301e0032b3394784b1078
- MD5 dcfd9d686b8d5a62592f9ecf04fe364c
- SHA1 cd34b4501274be5c4437df7dd10aaa7a8007d7f1
- SHA512 cf4b579d9daef2664fffa90a6b703ccb483a0745a5310b8225d51ce4777cc262aada233a99069a301c9f15874dc33666b25da49ee8e5878fa5eecf8f80248a89
- SSDEEP 98304:Ai9qgxK8mzHHtLK3BDhtvS0Hpe4zbpaAKQkroGIh3fkZcr:j05KBnvjeApaAvktYPr
- TLSH T1BCB69E82BE7084FECCB582308549A736ED317E5D79229A07F68CB75E7F322526921335
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\relog.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\comp.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\label.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\proquota.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\tree.com 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\write.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\efsui.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mode.com 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe -
resource yara_rule behavioral2/memory/5112-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x0016000000025a2d-5.dat upx behavioral2/memory/5112-494-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5112-3182-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\RenameConvertFrom.bat- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\f\SystemSettings.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.22000.1_none_165d5ffaf262c602\MuiUnattend.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.22000.1_none_c36af850083330df\PresentationSettings.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\smartscreen.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\spoolsv.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\f\fsutil.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.22000.1_none_85c196aa97db6b5a\Dism.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\f\PkgMgr.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\wowreg32.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_b98d3baff0bf243b\Register-CimProvider.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.1_none_d4af4db521f3ebaf\curl.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\AppVShNotify.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_478d6c55833b17ab\r\dcdiag.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_b5e493e3fca1e5c2\netsh.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\splwow64.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\CHKROOT.CMD- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.22000.1_none_ccd97e50f4c65861\ngen.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.22000.1_none_ff2cefc65fe79cac\alg.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\f\ApplySettingsTemplateCatalog.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\r\ie4uinit.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\lpksetup.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.22000.1_none_418429ddc6d1eb8f\logagent.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.22000.1_none_04376727db53ed5d\unregmp2.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\r\slui.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.22000.1_none_032efb965d531126\ftp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\f\CustomShellHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_0bba55ae109b8677\WmiPrvSE.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.22000.1_none_6c30c077bfa76b21\RegAsm.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchIndexer.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15806.0_none_f0ab60f89c5230a9\CasPol.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.318_none_de01ffa2be1c4596\memtest.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.22000.318_none_7f5bff6941991869\r\vmsp.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\klist.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_53b7d789a4e83f54\USRLOGON.CMD- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_929259dbf5f771f1\wextract.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_a8651901944b2dc3\TiWorker.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.22000.120_none_6698726619b2ab7a\f\PerceptionSimulationInput.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.376_none_2a06005b3bb58976\f\appidtel.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.22000.1_none_51ea28e567f7b61e\LockAppHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_2c29ad827f986a34\TSTheme.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.22000.1_none_c3ebc2d9be02340b\ieUnatt.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.22000.1_none_6dc8af5cc18b0564\auditpol.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\Spectrum.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_52811a677861148f\WFServicesReg.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.22000.1_none_5131b7cb34740693\LinqWebConfig.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\f\licensingdiag.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.22000.1_none_a7b29fe42d04be58\ClipRenew.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\perfmon.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\logoff.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\f\SearchFilterHost.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.22000.51_none_47d05adb57cc60db\r\UserDataSource.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.22000.1_none_033e889c5d44f379\UNPUXLauncher.exe- 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_dcfd9d686b8d5a62592f9ecf04fe364c_amadey_darkgate_elex_glassworm_hawkeye_remcos_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.0MB
- SHA256 f30b0091ff08394782146bb649edb11e15d943ee97ece42ee867000fd94249fd
- MD5 1d0948f4653849519a65699d692e9350
- SHA1 3aef968211a5d41562dea2a3fb803a40c776d2ef
- SHA512 e9c4a09e7589b22c3cd75c4ae5b6f104db0feff37a38a2fe0a00f0c8328abc8b62f3801a3c753c2f71b2d57851b17e53d58e39f22faed0d30eb7c333f09bcc74
- SSDEEP 98304:Ai9qgxK8mzHHtLK3BDhtvS0Hpe4zbpaAKQkroGIh3fkZcDjo5:j05KBnvjeApaAvktYPno5
- TLSH T166C69F86BE7085BECCB182708549A73AED313E5D3A218B47F64CB75E7F322925921335
- MD5 SHA1 SHA512 SSDEEP TLSH