Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 12:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe
- Size 8.6MB
- Sample260606-n9tpvset5n
- SHA256 eccbd74dcb5ac7a468a0343651161adaf01ba4c648491dcfff196892cfaa86f2
- MD5 00dc21cd1176d8b9d9bfa8377651fc99
- SHA1 a899a7476d6053a6d857ff04eb86a2665a7fe433
- SHA512 6b4e332ff027a5e9b68d8efd3aed2d948725ffc8aec2f8b5a43b37d86504cfea1146dd86b8ddcc230ea4ef62096c7e6448367b8701e4491f6d3a7367ccd0044d
- SSDEEP 98304:m9zEeYctixzy7tFOgc9fLnCKgv/R4NVSOv5xf4ObB9gjrExI:m9zEetczct8jK4NVSOvzgc4/EO
- TLSH T16A969E20F6D3C272D4D645F15A2DDB1F8429BE550B6088D7E3D8BE1EA8317C31A32B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 1 IoCs
pid Process 3944 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MI391D~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MIA062~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\pwahelper.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\INSTAL~1\setup.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~4.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\MICROS~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmprph.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmlaunch.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_proxy.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\PWAHEL~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\ELEVAT~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge.exe 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\BHO\IE_TO_~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~3.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~2.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 3140 3944 WerFault.exe 80 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3668 wrote to memory of 3944 3668 2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:3944 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3944 -s 13923⤵
- Program crash
PID:3140
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3944 -ip 39441⤵PID:3164
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe
- Size 2.4MB
- SHA256 bd7696911d75a9a35dfd125b24cb95003f1e9598592df47fa23a2568986a4a9a
- MD5 d9e8a1fa55faebd36ed2342fedefbedd
- SHA1 c25cc7f0035488de9c5df0121a09b5100e1c28e9
- SHA512 134644c68bd04536e9ea0a5da6e334d36b1ce8012a061fa6dabd31f85c16a1ac9eee8c40fee3d55f25c4d4edf0672de8ce204e344c800361cbcff092c09d7a33
- SSDEEP 49152:4TfiUEWo6zuEz439z99akTBc4O8b8ITDnlT4NvJX:4TfiG/nzU90T
- TLSH T153C59226A2C8C0EBE5642170CC59BBF900546D78DBA2CDD7BD447E16BA307D29533A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-06-06_00dc21cd1176d8b9d9bfa8377651fc99_darkgate_elex_glassworm_luca-stealer_manuscrypt_njrat_remcos.exe
- Size 8.5MB
- SHA256 80ce1ae363d69e897cc506c123fe9f9e376bfad67aba46fd4cec905e297d7a60
- MD5 57fa46419067658477fd64f43bfdd350
- SHA1 53fb4558716a7b36ef72076bd97a18146b85fe5e
- SHA512 1d875a91776c4a82849953c9650ab7e5585ea9e9a9df28384b35845a4797a722caf7d58bf76d685c76c9dfe66aac686cbdb2e08ae3b75c730921d1fe16925bf0
- SSDEEP 98304:S9zEeYctixzy7tFOgc9fLnCKgv/R4NVSOv5xf4ObB9gjrExU:S9zEetczct8jK4NVSOvzgc4/EO
- TLSH T14E969E20F6D3C272D4D645F15A2DDB1F8429BE550B6088D7E3D8BE1EA9313C31A32B66
- MD5 SHA1 SHA512 SSDEEP TLSH