Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/05/2026, 16:50
Behavioral task
behavioral1
Sample
2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
- Size 9.1MB
- Sample260523-vb8jpad18k
- SHA256 11cf4b9733830a87a598076d7e209954178a43c71c244c97d1858fc0f9aeb109
- MD5 6510cd1dee6afc5e805df24478269571
- SHA1 e059c92e50a921165dddd8b3a0caf7642b23d653
- SHA512 c802166a46088b33e32458beb417278a6dbe6319df7acb0012428feb05fe366df2b59cb5b47785f0235e6a931bc3112724d20e36bcc7ee4e80cf4d3dbf680417
- SSDEEP 98304:bbEpVGCwnTII2RxC3ud6MOIvysiWCQKzo5qphIHVruP3WpF3UdE1hZHEdLFnD9q:fuGGQnMkhgJuP32+dmhZk/nBq
- TLSH T17DA6AF2EBBE10032C96391759A5BA605E735F0036724CAD737CCC3981FB26E29536BE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\efsui.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\control.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\psr.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\print.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mode.com- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/404-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x002500000002b2a7-5.dat upx behavioral2/memory/404-730-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/404-3190-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\f\msinfo32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.22000.71_none_eba5201bcfa1aa33\f\licensingdiag.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_478d6c55833b17ab\dcdiag.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4374dc8b76e3bd2c\IMJPDCT.EXE- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.22000.1_none_182bd21b394d113f\upnpcont.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.22000.1_none_36b24ce0b35c1e60\IMCCPHR.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wabmig.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\r\PinEnrollmentBroker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.22000.1_none_a4bc36ae2cabd6e1\dllhst3g.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.22000.1_none_7a25fafa5e81834c\fltMC.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.22000.1_none_9f4e11aa607a66b3\GamePanel.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\winresume.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\f\nfsclnt.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\r\SecurityHealthHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5ba5eadfaddccaf4\wecutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.282_none_59d63580ebab6c4c\r\WpcTok.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.22000.1_none_f20a18a4fd0f4d43\LocationNotificationWindows.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\r\VSSVC.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\wevtutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15806.0_none_814d9cd431d93bd0\aspnet_regiis.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.22000.1_none_e92240163a52addb\ktmutil.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\msra.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\change.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.22000.120_none_0b04aa9dcb2db938\CredDialogHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.22000.1_none_033e889c5d44f379\UpdateNotificationMgr.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.22000.1_none_13d214402b909a8e\mavinject.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.22000.1_none_3b0bf3364e41c5b0\iscsicli.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\notepad.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\appidtel.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.22000.1_none_6672795e56429a85\netcfg.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\umount.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.22000.1_none_7a72c4e477e7b25d\dmcfghost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\f\klist.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\r\WerFaultSecure.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_0b6ad273acba9ca1\w3wp.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\f\SpeechRuntime.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\f\eshell.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\WFS.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_1baa132fc64be8aa\IEExec.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\f\WerFault.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\wsmprovhost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\Build.bat- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.318_none_5cc755143bc62566\r\ApplyTrustOffline.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\r\curl.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.22000.1_none_fe1f7fc320ca8300\clip.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.22000.1_none_868307884a64f50c\msfeedssync.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\r\wkspbroker.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_6510cd1dee6afc5e805df24478269571_amadey_darkgate_elex_glassworm_luca-stealer_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 9.7MB
- SHA256 f99261ef02abc3dc747c466b098b278a4f805da8de463c74612fa2e0aeca3718
- MD5 5bd17f4699782c41dfcceee489e26f27
- SHA1 712205453e7bcf09b17a143afc53ac1ec43afe4e
- SHA512 828ac112fe47f172ef10dfe7802e9ff306b126d9d4b8bd877746de9a06d30c4bac906639b517beb886b3da6507f54b2ada4fa4bcc2d15eb6002d5258ced94e72
- SSDEEP 98304:bbEpVGCwnTII2RxC3ud6MOIvysiWCQKzo5qphIHVruP3WpF3UdE1hZHEdLFnD9Wt:fuGGQnMkhgJuP32+dmhZk/nBgog
- TLSH T1D7A6AF1EBBE10132C9639175DA9BA605E631F0035724CAD737CCC3A81FB26E29536BB5
- MD5 SHA1 SHA512 SSDEEP TLSH