Analysis
- max time kernel
148s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 11:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe
- Size 5.3MB
- Sample260708-m4a5wsfv7p
- SHA256 fcf52fe935d67c1d69a1acc2eed97e7abc44a6b40a432ce291d93cbc9e41fb8d
- MD5 fb479ae4d13f52248763574f598abe9b
- SHA1 6b82ed342b73fc951ce232306eb659e1496af1d0
- SHA512 924d02c7104f1bd3d7fe74607f78fc553b4dbb37505f241e53d4ed71911884bb75bd689879b5275a778c51ae73b3cb0e5f1e4b355bb2729751601aeb6662ceae
- SSDEEP 98304:c17ZpRN8f01iuciNu2zPnj/7pxXX/1PTJxjRXz+1b:cPpRNwnYBzzXX/1Ldz+b
- TLSH T111465A16FF945476E1B206318DB6774C81697EB21B32C59B66843B0EEE31FC29931B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ipconfig.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\svchost.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\takeown.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\icacls.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\ftp.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\7-Zip\7z.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\r\smartscreen.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\mode.com- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.26100.1_none_694d5c871fe6dacc\CIDiag.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\LicensingUI.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\r\InetMgr.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_55e7b933a1108505\xwizard.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\fixmapi.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\imecfmui.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_2e8b40428114406d\jsc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_c319a5f63c95aa27\vbc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\SpeechModelDownload.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1_none_1df4641271a5054b\UserAccountBroker.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.26100.1591_none_4b326ab0aa8da2bf\DeviceCensus.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\explorer.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\MultiDigiMon.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1_none_7f9f7003cc70f4b2\regsvr32.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\r\msdt.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\r\WpcMon.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\bcdedit.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_8bd012a12d6af1f7\ntprint.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\MsSpellCheckingHost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\EaseOfAccessDialog.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.26100.1_none_136be58c8b89053d\sihost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\CheckNetIsolation.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1_none_0dbef45e6036c735\ComputerDefaults.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_93acbf7363320dcd\timeout.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1150_none_96f4f35e249cde0c\wecutil.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\showmount.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\r\iscsicli.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_b10653edb7a9547d\calc.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\msdt.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_fb479ae4d13f52248763574f598abe9b_amadey_darkgate_elex_kwampirs_luca-stealer_njrat_redline.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.3MB
- SHA256 f24837d52c25896e27430cbfe6f64bfd10576a4b860722ed89e103a3a61e39cc
- MD5 3a6354590734eb35d92a764b6e9e537f
- SHA1 e9a2df04419055547c67277aae0e8a35c8229df9
- SHA512 e9e3ae6e3360248fecb5653ff50f17b41379510b99f9bb3ab7f757f3f8eb19796cbc1866cf0d1157fdacaf5ab8fe8a6657c74b3a0a47f5eac9fec2b70c48c26c
- SSDEEP 98304:c17ZpRN8f01iuciNu2zPnj/7pxXX/1PTJxjRXz+1AezSC6v2XMH6:cPpRNwnYBzzXX/1Ldz+HR
- TLSH T165666B16FFA44572E0B24131C8B6B74CD5757EA20B3185DB62847B1DAE32FC29936B23
- MD5 SHA1 SHA512 SSDEEP TLSH