Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/06/2026, 04:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
- Size 1.7MB
- Sample260630-e35dcae12k
- SHA256 5a897199fd853d9cc97024de2b69c2a5af7142401d2bb014394b0c95b324c85c
- MD5 b7ac5d90819fcdc8f723b1f987995b58
- SHA1 851cb465e0ec4b525cc8c56cb6163a20b5859f8c
- SHA512 a463e82b337e8c7d80f484adbffc2e1f6d8f2c09a2c7a4a8f3fced30ff52229e6045673a345e3d17291e22c57bd761b06be76707567dcbc909a859b98cbef05e
- SSDEEP 24576:j4mW5mX6GEWem1gXq5L9uSWidgpm6hbpOSRKQ9:0m8HzXq5L9uiibpJKQ9
- TLSH T188854A11B7904128FDF316FA8AFE316C953DBAE0072890D762C46AED5A65BF17C32643
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\autofstx.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\sdiagnhost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\certreq.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\cmd.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\icacls.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\net.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\relog.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\win32calc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\upnpcont.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\cmdkey.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\eventcreate.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\curl.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\find.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\net1.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\TsWpfWrp.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\expand.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\systray.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\TpmTool.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\proquota.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\wextract.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\wusa.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\ARP.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\ktmutil.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\SndVol.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\subst.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\Dism.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\sc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Windows Mail\wab.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\Speech\Common\sapisvr.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\r\SystemUWPLauncher.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\readCloudDataSettings.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\dmcertinst.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\r\ChsIME.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\IEChooser.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\r\AgentService.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\LockScreenContentServer.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\r\lpkinstall.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmimageworker.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\r\imjpuexc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adamuninstall.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\r\at.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\convert.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\dpnsvr.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\r\MuiUnattend.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\fontview.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\PresentationSettings.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\bfsvc.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\r\securekernella57.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_931673d5fd963a61\driverquery.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\r\LockScreenContentServer.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\HelpPane.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4184 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe 4184 2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b7ac5d90819fcdc8f723b1f987995b58_amadey_darkgate_elex_gcleaner_luca-stealer_njrat_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4184