Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 04:42
Behavioral task
behavioral1
Sample
2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe
- Size 2.6MB
- Sample260629-fb7vtsev7k
- SHA256 4d2b271a72f578db23df3c1dac148d73d8effbc630281bfb51e1e6a120d489f4
- MD5 9af544acdf27754d40f0104f04fc7380
- SHA1 60a2c6613699cdb6eab5f98f764ae87212e16525
- SHA512 5b6359cc40c968010573fe3649bbf661ed2c83f945bbb1e860c859e037058bb0d298fbf6c87212a283b6ba9260d678f2dc9381a4c9c8d52e07f6a656b8c4be02
- SSDEEP 49152:WM84pNrRokpO+V8tgJd8i2mSdbDUAsHpD+bq:nfNrRokQ+CgayUbq
- TLSH T181C56A00A69480B5DC6E4D308A55A631F9707C9F7E2D724B6E60FB7A2FB36D1253A313
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\at.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\cttune.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\print.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\sort.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\attrib.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\logagent.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\psr.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\Dism.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\getmac.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\clip.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\cmd.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe -
resource yara_rule behavioral2/memory/3480-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000300000001b2d1-5.dat upx behavioral2/memory/3480-1034-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3480-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\7-Zip\7z.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\ApplySettingsTemplateCatalog.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\r\OOBE\OobeHostApp.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\imjpuexc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\r\iediagcmd.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\userinit.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_1fb74192d4a9efd6\InstallUtil.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingMasterScript.cmd- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\UCConfigTask.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\mpextms.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_1346e96d3ee86ee9\getmac.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\r\FaceFodUninstaller.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\splwow64.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\WPDShextAutoplay.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpCmd.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_492d9960807b3cd6\ipconfig.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\r\RelPost.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\r\MBR2GPT.EXE- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.26100.1_none_55a2ae3453d48859\setupcl.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\r\msinfo32.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\FESearchHost.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.26100.1150_none_d9f89d43802b0109\bootim.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4uinit.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_f151d0f42c5c742e\comrepl.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\Magnify.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\FileExplorer.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmplayer.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\r\nbtstat.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\sethc.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1_none_743122fc48bb736d\CameraSettingsUIHost.exe- 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_9af544acdf27754d40f0104f04fc7380_amadey_darkgate_elex_glassworm_redline-stealer_rhadamant.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 3.5MB
- SHA256 3dd484cab79096dd72240d6024e872c7e70883c0c6f63ce7fccd46c6cf5d5175
- MD5 3b2c44f91694650264ca9d53eef05bc0
- SHA1 ac63a3ce58e29a26b4a5128fde5e40208eaa2e91
- SHA512 f752bec178a0e7fa5385baf3e338eb6b872ed31ea8996544efe8253a5096e7f038af19e8b17843765a91b54808a2d2eddda5bb70927df0b9cde11c654f6f00da
- SSDEEP 49152:WM84pNrRokpO+V8tgJd8i2mSdbDUAsHpD+br/ezSC6vUzPvMHjy5:nfNrRokQ+CgayUbLezSC6v2XMHU
- TLSH T176065A11B5688262DCBE8C71C592A635F9313C8F7F2C768B1E41F7292E336E1553A326
- MD5 SHA1 SHA512 SSDEEP TLSH