Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:43
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
- Size 10.5MB
- Sample260707-c73dfagt5z
- SHA256 b45cb3057cb4ea188578160cf4961e572bfbf1916ddaeaf2ce165481ceeaced4
- MD5 7e25752ea23b22cfd97252c0c0003c65
- SHA1 fde0b335df5d092aeeb617758a9120936b587b8a
- SHA512 d4c7fba25dff2a91889971e6d479f70538aff7719cd57f19450bf8673b611f3cf054deca609a720a0013f339e5de2e4b25cc22b3613d1d25d3cf05901ca8674d
- SSDEEP 196608:eb3bPk5HyC8k5h/wDdEoNiV4I/WWwA7mIb3bPk5HyC8k5h/wDdEoNiV4I/WWwA76:eb3bPk5HPhJCIb3bPk5HPhJCt0R5I
- TLSH T116B66B41F5C380F1EEA34570A297F36F9725E5418120DDEAF98C2A46EF33692592E32D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpresult.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\convert.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\find.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\winrs.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\choice.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\svchost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\calc.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\r\InetMgr.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_b60058d9621fad85\wscadminui.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\DsmUserTask.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.26100.1_none_55d78c384ca248d1\csrss.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_bc8d33c5efdd20ef\edpnotify.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\r\rdpsign.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\r\winlogon.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\CheckNetIsolation.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\IMESEARCH.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.26100.1591_none_50ccbceb26d74098\fhmanagew.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\r\fsutil.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\odbcad32.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\r\StartMenuExperienceHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\r\PickerHost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\TCPSVCS.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\WinSAT.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\mpnotify.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_db37a096a5a2d301\vbc.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\r\SIHClient.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\r\AppResolverUX.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-add.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIdentity.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\r\LanguageComponentsInstallerComHandler.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\r\RunLegacyCPLElevated.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.26100.1591_none_2af0eb0ad05bac33\r\tzsync.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7e25752ea23b22cfd97252c0c0003c65_amadey_coinminer_darkgate_elex_glassworm_luca-stealer_nj.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5580