Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/07/2026, 20:33
Behavioral task
behavioral1
Sample
2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
- Size 17.7MB
- Sample260719-zbv1taev71
- SHA256 27a2029144815f809ce31fb42e230c5441f23c9c001a0f79f3f3891e310f051f
- MD5 f3a5b8c3a240f93e07b91930f7c12661
- SHA1 675f8983d49b4e842cad140ff567dde7bcecccb7
- SHA512 72fd1045183f2f5ee0a2c2153df9694ea76a0d45020312598f7dfb83805e92f981908f83af3e68af7f2ffa62abf42708afa6fc6da18a2f3ef5aff23695f5cb0f
- SSDEEP 196608:ShwZi32PVTfYobbrx/NsqXd2VBlfDDAGms4:Syo6PHnbolfXYs4
- TLSH T1601739037EB8D9A6E86FB9B4C858D670ED343C151922661779E0BF1EAE336D06D18331
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0006000000009dc3-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0006000000009dc3-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ARP.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\write.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tree.com 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\where.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\convert.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\newdev.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\notepad.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe -
resource yara_rule behavioral1/memory/2016-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0006000000009dc3-5.dat upx behavioral1/memory/2016-392-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2016-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\SyncAppvPublishingServer.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_b0feb06b14107c04\wecutil.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmLpac.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\dstokenclean.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1151_none_cf9de3ecb3a8f61c\f\BrowserCore.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\Win32WebViewHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.19041.1_none_56138d203a7fc4cf\LogCollector.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c9c647e748814b31\WsatConfig.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\AtBroker.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\f\nvspinfo.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_18520236ff9eab63\colorcpl.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.19041.1_none_597912734561c5f4\ucsvc.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\f\wuauclt.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\ChtIME.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\regedit.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\phoneactivate.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.19041.1_none_afdc734db4fba076\takeown.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\vmwp.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\f\MdmDiagnosticsTool.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorQuickStart.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\rdpclip.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\r\netbtugc.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\MBR2GPT.EXE- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\f\gpscript.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ARP.EXE- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\r\drvinst.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\r\BackgroundTransferHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\r\AgentService.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_ff0c3fa49f6aa0fe\dsacls.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\sihost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\find.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_6c7de5b30e8f6071\f\BackgroundTransferHost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1_none_3c360c9e8a3e64cb\msinfo32.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\RuntimeBroker.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\InputSwitchToastHandler.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\spoolsv.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\wowreg32.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\iisrstas.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\r\autoconv.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\f\wbadmin.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.746_none_1eeb97b23978a488\desktopimgdownldr.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_aa1fc2e87b362d12\regedt32.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\SETPATHS.CMD- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\f\upnpcont.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\wusa.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_1ec972de354a6d3f\diskpart.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.1_none_da5b9e6604736fbe\IEChooser.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\usocoreworker.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f3a5b8c3a240f93e07b91930f7c12661_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.2MB
- SHA256 16bf175457881ea9356bc09951dca2b7bb71ec3bfcbfa093e0ae5bbdeed9ae04
- MD5 4b26da583bcd39f490ed04ef6e053e19
- SHA1 3e6f988c4226c28826eb2676ac764d54ef005b32
- SHA512 ab3a5e31b1020851a03ce6ee3a56dfac4037d4944120c2c0201742fd1da77919aceb3c0e48c7cd84b6d96846cd9636464f91076a90d5876213758c372761d435
- SSDEEP 196608:ShwZi32PVTfYobbrx/NsqXd2VBlfDDAGmsCoA:Syo6PHnbolfXYsVA
- TLSH T1E01739037EB8D9A6E86FB9B4C858D670ED343C151922661779E0BF1EAE336D06D18331
- MD5 SHA1 SHA512 SSDEEP TLSH