Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:04
Behavioral task
behavioral1
Sample
2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
- Size 4.9MB
- Sample260808-bfemmazvcw
- SHA256 907f5ed9300b0b30b308813ce9403c2c6e813ec494e3dbb5b7799629283ab4f7
- MD5 7e152fee2e4c6ba08d75027c15c52f36
- SHA1 5495af7d824bff2af977f740eb556e9ec45926bc
- SHA512 bee7c11f841dd04f358ea9d36a6b54a9f745a09cfb597cd00cfb9f5efd30a2e97cac333434d8e20aaf48a70c3e6862fb61858f282a076495bc1fcb1d12427bb9
- SSDEEP 49152:fkYw9sgydB3ImIR8ILfUdcY/9k9akOElMaFLkMKeW4SkZP4sz9Mb0pYqG:fMsgWCmIiYL9ak7QfkZc06J
- TLSH T11B361A11BAE98732C87181708FB9AA88A5313C505771CACB22857E9DFE732D5593F633
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\at.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\find.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/1228-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c465-5.dat upx behavioral2/memory/1228-683-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1228-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\FESearchHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\unregmp2.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\chcp.com- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiWorker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\r\AggregatorHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseTVM.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1_none_d3ac672b8cd9f8b1\fsutil.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\ApplySettingsTemplateCatalog.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\r\at.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_2a2ee039ba45ffa6\dw20.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\r\fclip.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\r\upnpcont.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_39d8198a6bf822dd\WWAHost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1_none_216e3761f97ed1b2\sdiagnhost.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7161e3793d394d15\sc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qappsrv.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUx.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\r\hh.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiFileFetcher.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\userinit.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\r\XGpuEjectDialog.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_b21add2e107e23b6\w3wp.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\dsmgmt.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\ImagingDevices.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_0e2538fcfbcfdda3\certreq.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\repadmin.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\mspaint.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1150_none_ad5d9bcb00930036\ndadmin.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\FileDialogBroker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1_none_f6992c40f1427a7d\mobsync.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\containerworker.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.26100.1_none_6286baeedbc54537\LogonUI.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuauclt.exe- 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7e152fee2e4c6ba08d75027c15c52f36_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.8MB
- SHA256 e5f0dadfc8633e4fdbf377258f0be6a5e1084df8f13f1091c083f753a67e0eda
- MD5 8ca223fa888d94654d8ca3f9900e3720
- SHA1 0d22152757c8be6c5b12dad280f7b8739e7d2601
- SHA512 fbbdfa4e8748d03689fa7689f63494245de87750808d9d7970993c2552bf29094b663f5e3378231905b8d38ab6d4a3fec5a67c719e1acac4fbf946a576421875
- SSDEEP 98304:fMsgWCmIiYL9ak7QfkZc06mezSC6v2XMHF:2v7OP06Fe
- TLSH T1E0563B11B5B98732C8728170CFA9AA89A9313C405771CACB2285BB5DFE732D5593B337
- MD5 SHA1 SHA512 SSDEEP TLSH