Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 17:57
Behavioral task
behavioral1
Sample
2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
- Size 10.9MB
- Sample260720-wjvs8sb16s
- SHA256 c49ae24b354dcf35a88899219b2173e9aa4efaff063fd970a67c5e94608db853
- MD5 32b2a31367f0bfdad765fcc23f8c61af
- SHA1 05480f9fc500cc499d7c88d9b4b50eeeb50223dc
- SHA512 9332fba9c22f219e4a85adaef5fb5e9b598e2a50ae83281048d0fc92c15e025c9ca7adfe18c8c6cc380a8c22bcfa27469c979d2cfa2a5c4f9762e26f06926b58
- SSDEEP 49152:JxpM84poxzLrRokpFVZS38xmN3Aek03noj45wlDT3ugx/T3S9tsgX8zEC8ULgCSZ:OfkrRokxZaeUJF3noxDDu6/TIOSA6joy
- TLSH T1F1B6D503AD7CED2AF96E3DB5C858DA749C183D2969633426B9F0BF5EE4325C17608231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5d0-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c5d0-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\proquota.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sfc.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\mode.com 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe -
resource yara_rule behavioral2/memory/3624-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c5d0-4.dat upx behavioral2/memory/3624-422-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3624-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpremove.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_cb7026b6ea62c346\whoami.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\r\colorcpl.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\tree.com- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\r\omadmprc.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.26100.1150_none_4ef2fca3d76b94b2\r\UPPrinterInstaller.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\r\hvsiproxyapp.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\r\RdpSaProxy.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\WaaSMedicAgent.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5f97775aa22929cb\cacls.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\r\Utilman.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1_none_f6992c40f1427a7d\mobsync.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.27000.360_none_db37a096a5a2d301\vbc.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1_none_2e77de14f6a20404\findstr.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizardElev.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\rekeywiz.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\FileExplorer.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\r\Setup.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\SpeechModelDownload.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15912.0_none_c2b647ba71508734\dfsvc.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\AppVDllSurrogate.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_a44e7056d0e44981\r\TpmTool.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\r\rstrui.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_9dcb4fe8bf21aec2\RegAsm.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wabmig.exe- 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_32b2a31367f0bfdad765fcc23f8c61af_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer_njrat_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3624
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.9MB
- SHA256 c7276b28af2a979ac251ded367189137edc8627c2794df14e0b2bad264c36314
- MD5 3c9be54a5024882505d01a8d1e097d84
- SHA1 2e737fb31db50cfdc6b28da8aa4c6c11e09fa239
- SHA512 a63636801b036ddb5006881fd22b0fddc21a414cb74017c531ea7325793a1dcf3ced8c98152ccfbeebdb8414f25e7922b420682d3ba87a9bb755a0fb40289890
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jojezSC6v2XMHZ:ShwZi32PVTfYowm
- TLSH T12CC6F603BD7CDD2AF97E39B5C898DA749C283D196A237456B9E0BF5DE8321C17608231
- MD5 SHA1 SHA512 SSDEEP TLSH