Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 01:04
Behavioral task
behavioral1
Sample
2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 4.9MB
- Sample260808-bfemmazvcw
- SHA256 907f5ed9300b0b30b308813ce9403c2c6e813ec494e3dbb5b7799629283ab4f7
- MD5 7e152fee2e4c6ba08d75027c15c52f36
- SHA1 5495af7d824bff2af977f740eb556e9ec45926bc
- SHA512 bee7c11f841dd04f358ea9d36a6b54a9f745a09cfb597cd00cfb9f5efd30a2e97cac333434d8e20aaf48a70c3e6862fb61858f282a076495bc1fcb1d12427bb9
- SSDEEP 49152:fkYw9sgydB3ImIR8ILfUdcY/9k9akOElMaFLkMKeW4SkZP4sz9Mb0pYqG:fMsgWCmIiYL9ak7QfkZc06J
- TLSH T11B361A11BAE98732C87181708FB9AA88A5313C505771CACB22857E9DFE732D5593F633
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\net.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral1/memory/4920-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000b00000002430e-5.dat upx behavioral1/memory/4920-946-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4920-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-agent.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\r\runonce.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_c9f3f831b5b3535d\PinningConfirmationDialog.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_4ae21b160a9d5bb2\r\CameraSettingsUIHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\r\WWAHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winload.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1_none_9053c2b542fdf1c3\BitLockerDeviceEncryption.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_c47fb20821633815\imecfmui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\UserAccountBroker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\LaunchTM.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\f\cleanmgr.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3038e0b9fa4d9cdf\DpiScaling.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9\r\HelpPane.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\iisreset.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\Microsoft.AsyncTextService.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\aspnetca.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\mofcomp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a89f46f8bfac0a1e\AppLaunch.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_aa218bebc7c352ef\upnpcont.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_8ec2362c55947137\whoami.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\mstsc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\runonce.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\LicensingUI.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\WaaSMedicAgent.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\f2329d4736e5d7010ba200001815341f.iissetup.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\wscript.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevTemplateConfigItemGenerator.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.19041.1_none_05325e2f9f9e6b0a\ldp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\f\printfilterpipelinesvc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.19041.1_none_389cd5270341e0a8\regsvr32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\wdagtool.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qappsrv.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a7a9eea53631000d\aspnet_state.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\r\diskpart.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\wermgr.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\r\nltest.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\f\dfrgui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\r\printui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\f\WSCollect.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\f\tttracer.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..egistration-cmdline_31bf3856ad364e35_10.0.19041.1202_none_b3f538f2c4a648b2\dsregcmd.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.19041.423_none_12ca604b48f8d3fb\r\CapturePicker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpshell.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\WMIADAP.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1_none_bf56a5e7532d9c79\licensingdiag.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_f28c973357fcbd08\IMEWDBLD.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4920
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.4MB
- SHA256 18dad763d22858100a8e89fd9a4e2350f28280b0cb75c148f889bb8faa00cfe7
- MD5 71b3236c45ad03f0a684deb95188ddcd
- SHA1 d990f78e673c8e20073382c356486de83b383cd3
- SHA512 cd18bd58a7343ed3d20f54bde1f3b9d5efa348009d9064a7acb01f5a3a2b753e011683a39861b2e77d42cd0c8b20ba1a4757e33eb59484b23716cb8b887f20e5
- SSDEEP 49152:fkYw9sgydB3ImIR8ILfUdcY/9k9akOElMaFLkMKeW4SkZP4sz9Mb0pYqsPji0AjY:fMsgWCmIiYL9ak7QfkZc06djo8
- TLSH T149462B11B6B98732C87281708FB9AA89A5313C405771CACB2285BB5DFE732D5593B733
- MD5 SHA1 SHA512 SSDEEP TLSH