Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 13:05
Behavioral task
behavioral1
Sample
2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
- Size 9.3MB
- Sample260420-qbppcsbs5k
- SHA256 427e85113f61ca38b6faf17a8312a8959183b7ddc1c37447caaed68ae52392a2
- MD5 6b8a8a766a61b17eeb737dd006a9a0f4
- SHA1 9d8b2917acb2892d79d984c9fec5d4da6cdde748
- SHA512 6e0fde0b7ed8e6fab85ccc4a0a5b2265a77aaa674daa46024915103d82197d6000a374d2bbdf4b79403140b729ceee37a7cdd97b98bc49956241f9b64e8ad41a
- SSDEEP 98304:esxfRjxAZf9FDG+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsm/:389dmA39aNwnYBzzXQ
- TLSH T1AAA6C585AEC1987ADCAD0E300965A739F4247E9F7C1E7906EE403B4EF677EC16814632
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\write.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\more.com 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\tar.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\tree.com 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\winrs.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe -
resource yara_rule behavioral1/memory/1116-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a000000024076-5.dat upx behavioral1/memory/1116-669-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1116-3208-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\Pester.bat- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_d12f2a9a88909fc2\iisreset.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.19041.1_none_c27f721834e813f5\bootsect.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8171817405d01500\nslookup.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\logman.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.1_none_4eca52bc837e6422\BackgroundTransferHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_a2eda420e70d2fc8\dsacls.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\fc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.1_none_5eda5fa3fa7c0fb7\alg.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.19041.1_none_ba15c535035058c0\rdpinput.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1266_none_30abd5bf5f509a14\Windows.Media.BackgroundPlayback.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\ScriptRunner.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\FilePicker.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\f\SIHClient.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.CscUnpinTool.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.844_none_ef8661e4d6535c5c\f\TabTip.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\audiodg.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\r\SearchFilterHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.1_none_f4db83a870443aa2\CloudExperienceHostBroker.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_e4c1e71455c2721c\appidtel.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiWorker.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\f\WmsSvc.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\convert.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\WmsSessionAgent.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\f\cmdiag.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.19041.1_none_b970f5eb6342eadb\dpnsvr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\r\pacjsworker.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_18b834522b9eb97e\expand.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\f\PasswordOnWakeSettingFlyout.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.1_none_9b8799837b1e944c\WindowsSandbox.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchIndexer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\hh.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\AppVClient.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\Taskmgr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\r\msinfo32.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.19041.1266_none_3b00801193b15c0f\Windows.Media.BackgroundPlayback.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1_none_82af78fa7992ecce\uwfmgr.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\f\sdbinst.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.1052_none_073e2a212d1697e6\r\ApproveChildRequest.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\bash.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\chgport.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\r\sihost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.1_none_c3249fe181844dfb\MsSpellCheckingHost.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1_none_8119ed75508e4ffe\wevtutil.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateBaselineGenerator.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_6b8a8a766a61b17eeb737dd006a9a0f4_amadey_cloudeye_darkgate_elex_glassworm_luca-stealer_njr.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1116
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.8MB
- SHA256 f849069e7f8ddd9a82fa0c7aaacb27b3cef06b979d1dacdcb46d478865cb987e
- MD5 89d94d0ca0691e2e6b64d32411772226
- SHA1 8af868d5451bf32321de44beadb86b48117f0c33
- SHA512 496527c472cafc56f1afb27aca8e4b8740f87b1b643d2eeb3284089b20690b71771ae0ecc305a8df5c05dbfe5c13485eb70c34063ad5e41978c5c6e127de0866
- SSDEEP 98304:esxfRjxAZf9FDG+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsm4:389dmA39aNwnYBzzXqoR
- TLSH T1BEA6C585AEC1987ADCAD0E300965A639F4243E9F7D1E7906EE403B4EFA77EC16414732
- MD5 SHA1 SHA512 SSDEEP TLSH