Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
30/05/2026, 14:29
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe
- Size 4.8MB
- Sample260530-rt3vdagy8n
- SHA256 b2f1f879e1086075facdc87a17ece9fce22f628b7d8827d4b6d922a825cac721
- MD5 4002e2f105608d3f3102842a950b7917
- SHA1 5f254ba0c9576a74d1bf9686df3cfdadbe0732e8
- SHA512 9b4968f6d8ee393dd9d0b46683181d37304d2b98860398a198358f206d3aee07d7c6c0ae864bdd5b5bdc57a29a0783eef671be193321f22cfe665e048ff06a25
- SSDEEP 98304:DIUuM0fZaQOhK0IUuM0fZaQOhKIUuM0fZaQOhK:huBLOgUuBLOUuBLOg
- TLSH T10A366A02769DBCF1C17250304B7A97F25B2DFC211950D64F73D4BB296E38683B629B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\Setup.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupPrep.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.22000.120_none_9ed34dd5b0c53507\f\WpcUapApp.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\sysreset.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\f\ksetup.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.22000.120_none_6698726619b2ab7a\f\PerceptionSimulationInput.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\f\MoNotificationUx.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\hh.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\f\provtool.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\BrowserCore\BrowserCore.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\f\WpcMon.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpinit.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\f\MDMAgent.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\f\PinEnrollmentBroker.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\f\rdpsign.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmplayer.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\f\SearchApp.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\sdchange.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.22000.71_none_bcb9c63bb991a4c6\f\msconfig.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\f\PkgMgr.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\f\ShellExperienceHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\ResetEngine.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\Boot\PCAT\memtest.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.22000.318_none_701008567a383b30\f\AggregatorHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\f\CustomShellHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\ResetPluginHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_823a5b3dd9c522d8\f\net1.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\splwow64.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\f\SystemSettingsBroker.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupHost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\f\LockApp.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\f\OOBENetworkConnectionFlow.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.22000.282_none_85f8b97e4dbf9185\f\wpnpinst.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\cscript.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\f\BdeUISrv.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.22000.282_none_3c5af3814be830ab\f\klist.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpshell.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpinit.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1152 2076 WerFault.exe 79 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-30_4002e2f105608d3f3102842a950b7917_amadey_coinminer_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 3162⤵
- Program crash
PID:1152
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2076 -ip 20761⤵PID:4460