Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 16:50
Behavioral task
behavioral1
Sample
2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
- Size 9.1MB
- Sample260523-vb8jpad18k
- SHA256 11cf4b9733830a87a598076d7e209954178a43c71c244c97d1858fc0f9aeb109
- MD5 6510cd1dee6afc5e805df24478269571
- SHA1 e059c92e50a921165dddd8b3a0caf7642b23d653
- SHA512 c802166a46088b33e32458beb417278a6dbe6319df7acb0012428feb05fe366df2b59cb5b47785f0235e6a931bc3112724d20e36bcc7ee4e80cf4d3dbf680417
- SSDEEP 98304:bbEpVGCwnTII2RxC3ud6MOIvysiWCQKzo5qphIHVruP3WpF3UdE1hZHEdLFnD9q:fuGGQnMkhgJuP32+dmhZk/nBq
- TLSH T17DA6AF2EBBE10032C96391759A5BA605E735F0036724CAD737CCC3981FB26E29536BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\svchost.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\expand.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sort.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\write.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\convert.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe -
resource yara_rule behavioral1/memory/960-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x001000000001e83c-5.dat upx behavioral1/memory/960-724-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/960-3232-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\ReceiveMove.bat- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1_none_0d7764d82a75e629\BitLockerWizardElev.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\f\wscadminui.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\wusa.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\Setup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\r\mspaint.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVShNotify.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\sethc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\r\autochk.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1_none_a78dc4e9f3c6c606\bdechangepin.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_389cd5270341e0a8\regsvr32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevAgentPolicyGenerator.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\f\WpcMon.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\services.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\r\XblGameSaveTask.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\f\CloudNotifications.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.746_none_e180169f2d62e633\r\wmpnetwk.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\fontdrvhost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\tracerpt.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.1_none_eaaf89ba8994910d\CapturePicker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.19041.1_none_e15558ebc4b8bd81\iotstartup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ace9914536e5d7010a9b00001815341f.WMSvc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\dxgiadaptercache.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.1_none_5c015a65c60d8097\hnsdiag.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\r\CastSrv.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.19041.1_none_403af5649d7b9685\Eap3Host.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\r\WerFault.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\f\IESettingSync.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\f\quickassist.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\r\wininit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\EaseOfAccessDialog.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVShNotify.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\cmd.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFault.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\r\PinningConfirmationDialog.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_6a5de40c0a30489e\IEExec.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\f\wermgr.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.19041.1_none_83ab1c56c187ef65\Windows.WARP.JITService.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\f\SystemUWPLauncher.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\iissetup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\f\vmwp.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1_none_f526198caecd7792\dsregcmd.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\f\sdbinst.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\r\ClipUp.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\f\PktMon.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.844_none_487fcc4fe2c3cfbb\provlaunch.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\rdvgm.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.7MB
- SHA256 f99261ef02abc3dc747c466b098b278a4f805da8de463c74612fa2e0aeca3718
- MD5 5bd17f4699782c41dfcceee489e26f27
- SHA1 712205453e7bcf09b17a143afc53ac1ec43afe4e
- SHA512 828ac112fe47f172ef10dfe7802e9ff306b126d9d4b8bd877746de9a06d30c4bac906639b517beb886b3da6507f54b2ada4fa4bcc2d15eb6002d5258ced94e72
- SSDEEP 98304:bbEpVGCwnTII2RxC3ud6MOIvysiWCQKzo5qphIHVruP3WpF3UdE1hZHEdLFnD9Wt:fuGGQnMkhgJuP32+dmhZk/nBgog
- TLSH T1D7A6AF1EBBE10132C9639175DA9BA605E631F0035724CAD737CCC3A81FB26E29536BB5
- MD5 SHA1 SHA512 SSDEEP TLSH