Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:18
Behavioral task
behavioral1
Sample
2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
- Size 16.3MB
- Sample260718-bn6fbafv2s
- SHA256 214fb4919d0a9ed37e40eb954b3b70c6a51454976ce9b986a60ea32aa0838105
- MD5 ffbbf59779cfdbe2488eee171f0750ec
- SHA1 bacbcf428a71e97e3175c202eecd907097526a41
- SHA512 4c39059649847a6b6672733a5d8043b83b6e17c22af08220b97bc70b87369613457663b5514ffa1436131eba356e69bcfdb60e96c990ce399941807799bedd24
- SSDEEP 196608:S9DvUFfBnvjeApaAvkt+eGZF6bUpMBF1p/kjRm4OWi2b9ou:S6NvjtIAvkQIbUwF1VERmj2bSu
- TLSH T11707BE436EAC85A9DDAF7E304958D776D9313E0834216A06AEC07F5EFA326D17A1C334
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\at.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\help.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\fontview.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\takeown.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe -
resource yara_rule behavioral2/memory/1152-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001300000001157e-5.dat upx behavioral2/memory/1152-346-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1152-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmUi.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.26100.1_none_c842a966f62dd0c5\FirstLogonAnim.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wabmig.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\vmplatformca.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_08f23f1b0a87acee\getmac.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1_none_10c9402dd04d0788\PresentationHost.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\ImeBroker.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\r\plasrv.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_98d146a6029264ee\vbc.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\FESearchHost.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\OfflineScannerShell.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.SyncController.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1_none_df337d63f8ff3ba4\iscsicpl.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_9f7e48f0022da658\aspnet_compiler.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\r\aitstatic.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\DWWIN.EXE- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\r\wextract.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_7da6e7654a833d6c\PeopleExperienceHost.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_8e244623f18086ce\net1.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.26100.1_none_1c735df6df567cc4\RemotePosWorker.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\FilePicker.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\provlaunch.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_ffbbf59779cfdbe2488eee171f0750ec_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1152
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.2MB
- SHA256 26db3471f8e515193e4f46cb1afc6b6e8ab5f4e2359ca9fdb9825d3155223348
- MD5 597b6840d88edf371f994f1822663eb2
- SHA1 0fb46ba5c9ef1743bbaf7a88ae8037571aa1fb41
- SHA512 b5afb78073bd74508e46daf306ef43d6a8f406ae472def55610e991f0732b9725e627ed9664f1da1bdbfc3357d63cd5edd70fb6daf90a5ff034b669afcce8939
- SSDEEP 196608:S9DvUFfBnvjeApaAvkt+eGZF6bUpMBF1p/kjRm4OWi2b9ocE:S6NvjtIAvkQIbUwF1VERmj2bSd
- TLSH T1A607BE43AE6C86A9D8BFBE308858D776D9313D0925215A07AEC07F5EFA326D1752C334
- MD5 SHA1 SHA512 SSDEEP TLSH