Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 18:01
Behavioral task
behavioral1
Sample
2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe
- Size 7.9MB
- Sample260504-wl2dssdw9k
- SHA256 55f5ba12276988a0d070256950f360b381e68626ea62286df81145ff3ed444a9
- MD5 264d4d22236fb6ad87f623096e7e69af
- SHA1 7deb2b8a50da9d9d6e466914e25cac626e738bd5
- SHA512 6a11227a6a2e5a089339b65c3dbf230553a5bef0dde518052febb645b8cf70e0336cd9194aa432663d8b612d6122dae06cc4247d53a5abe172077d797883f408
- SSDEEP 49152:g/jHWFw7sEp64iEOog6f6daLWo3n2bjlJ+MYu8m1/N9hGTVBXdcu:gIw7fp/iEOovSdaigxK8mzHOdB
- TLSH T19486F812EF4D9C26D42E3D710C7F87A804E07C1979127946B9CC3EDAE7BEAC1699C225
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\label.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\expand.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\ftp.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\help.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\relog.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\at.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\compact.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\more.com- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\runas.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe -
resource yara_rule behavioral1/memory/1556-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000c000000024299-5.dat upx behavioral1/memory/1556-752-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1556-3204-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_a541e711f3b2a478\mobsync.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.572_none_846686e46b73c8e3\f\PnPUnattend.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\provtool.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\runonce.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\r\hvsimgr.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\LockApp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\r\UIMgrBroker.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseCncProxy.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_98f5b8d3db68981e\dcomcnfg.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.19041.1_none_eb848512bf047a3b\sfc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\r\wermgr.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_2e482ad4cee11ead\regsvr32.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_2cda3b956fcdb26f\InfDefaultInstall.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmstp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\SecurityHealthHost.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsirdpclient.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvax64.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1_none_82af78fa7992ecce\uwfmgr.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\f\runonce.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9c6e71eba56e4081\userinit.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_d31059e0b2fa6d47\aspnet_regiis.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.1_none_cf7ec085c4b5345c\fltMC.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_5f45625010b4cd19\InetMgr6.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.19041.1_none_0d20194b69a60627\label.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\f\TokenBrokerCookies.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\r\fhmanagew.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.1_none_de2fb5dcf9b35f74\taskhostw.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\r\DWWIN.EXE- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.1_none_4fb50fb329007a5d\SnippingTool.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tsdiscon.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\CameraSettingsUIHost.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.1_none_7e470436241a018f\hh.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\tpmvscmgrsvr.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1_none_e3ab86b70c430b3c\wordpad.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.19041.1_none_77d767642c0e040b\chkdsk.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.19041.1202_none_fdbbcf53ca14e151\r\wimserv.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\f\SystemUWPLauncher.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\r\PickerHost.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15805.0_none_5643c883846b0513\aspnet_wp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\f\bfsvc.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_1ec972de354a6d3f\diskpart.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\r\ntoskrnl.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\logman.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\VSSVC.exe- 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_264d4d22236fb6ad87f623096e7e69af_amadey_darkgate_elex_icedid_njrat_redline-stealer_remcos.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.5MB
- SHA256 841d54868f46501c1956a202ec0ba37cc7a1b8f93b6b9c0d871cde8d62e81e28
- MD5 b70d5d50ec0d1fb085ae5c89eca7b6d4
- SHA1 aaf0ea25c78c520a52c4f3133595d21784ac93bb
- SHA512 d9209c04d0e71e2b78caab1351e0b6471cf0ed209a08915a12436b36cec692dfcbed10b20e5a92e565108835c3245650fca8d7ee9518f1f2d7517ca62426ec00
- SSDEEP 49152:g/jHWFw7sEp64iEOog6f6daLWo3n2bjlJ+MYu8m1/N9hGTVBXdckPji0AjH:gIw7fp/iEOovSdaigxK8mzHOd1joL
- TLSH T15B962B12EF4C9C26D42E39714C7F87A814E03C1979127946B9CC3EDEEB7EAC1699C225
- MD5 SHA1 SHA512 SSDEEP TLSH