Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe
- Size 13.5MB
- Sample260814-jgqehsfk3w
- SHA256 3a483c77bf6e91be59808b54d557da6be9c76b140dd5a4b52c27242c1bb51a27
- MD5 789c72e0bec39fbdb46e2c5f1b647767
- SHA1 83d19dddfc41b7dd94f8c9044755d9a6ffd70a22
- SHA512 7d9d1a11eae20f167fd31d65839608fb9f820b73d38a427014de0166f062d51a5005ce521dd1a570f8258d96b1f07550a330a25f7c58e041b1c758099d81e3f3
- SSDEEP 196608:twRjoL2RNRoreGZF6bUpMBF1p/kjRmLeGZF6bUpMBF1p/kjRm4OWi2b0oB:JCQjIbUwF1VERmDIbUwF1VERmj2bLB
- TLSH T126E6F115F6B48335E073C079C5E3D65AEA3238835B3985CB1385AB6D2E376D28A36731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe smrss.exe" 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Executes dropped EXE 1 IoCs
pid Process 5484 20410.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\esentutl.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\ieUnatt.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\Fondue.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\ipconfig.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\openfiles.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\OposHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\print.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\unregmp2.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\wscadminui.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\LaunchTM.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\diskperf.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\efsui.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\psr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\replace.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\forfiles.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\Robocopy.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\ROUTE.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\taskkill.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\wscript.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\compact.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\msra.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\wermgr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\mtstocom.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\raserver.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\expand.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\find.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\mspaint.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\tracerpt.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\xcopy.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\edpnotify.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\icsunattend.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\mobsync.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\resmon.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\winrshost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\diskpart.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\hh.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\reg.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\shrpubw.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\tttracer.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\logagent.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\mmc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\ddodiag.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\java.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\cmd.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\PasswordOnWakeSettingFlyout.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.26100.1_none_3182dffdaeb31123\SrTasks.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiFileFetcher.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_ddaf5dc661e91ea5\aspnet_state.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_0e2538fcfbcfdda3\certreq.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrs.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_32cfdebbd01210f7\aspnet_regsql.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_b667649ed5836b0d\aspnet_regiis.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\r\IMJPSET.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\r\dmclient.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUx.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_bdae08941820f568\waitfor.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-packageinspector_31bf3856ad364e35_10.0.26100.1_none_6775b02f27bc2b3e\PackageInspector.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\r\wowreg32.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\netsh.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\Windows.Media.BackgroundPlayback.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\PhotoScreensaver.scr 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_5c657b87715a8e52\aspnet_regbrowsers.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\r\AssignedAccessLockApp.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\ReFsDedupSvc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\reset.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\r\UCPDMgr.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\FESearchHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\WinSAT.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\r\wbemtest.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\rrinstaller.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.26100.1_none_d0ec8cfb9f5f4c00\ADSchemaAnalyzer.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1_none_6abdc3ad5e5ae2d2\RdpSaProxy.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\r\DWWIN.EXE 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\WorkFolders.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\r\kdnicctrl.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\r\winload.exe 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 620 wrote to memory of 5484 620 2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_789c72e0bec39fbdb46e2c5f1b647767_amadey_darkgate_elex_luca-stealer_njrat_remcos_rhadamant.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620 -
C:\windows\temp\20410.exe"C:\windows\temp\20410.exe"2⤵
- Executes dropped EXE
PID:5484
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 15.6MB
- SHA256 dc94b7d4392e54d9c918682a29be7fb07c7dccad87fd6082fc81b2d2247f16be
- MD5 b1f467bbb1fadaeba8c0ed0e44af0e06
- SHA1 9a3ebf3e647d28cb7a12717184b356eb9817a56f
- SHA512 fd8eb75b073905a33c0fe00e96641e0459c0d176dd8294fa4ad38619f6a9bbd71f3fa8dc6e8042494bbc0d27f154c978eeb8365616a64ecfcd5a386818d924ac
- SSDEEP 196608:twRjoL2RNRoreGZF6bUpMBF1p/kjRmLeGZF6bUpMBF1p/kjRm4OWi2b0ohGnM:JCQjIbUwF1VERmDIbUwF1VERmj2bLhGM
- TLSH T176F6F115B6B88375D0B3C179C5E3D65AEA3238424B3596CF1295972D2E33BE18E3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\20410.exe
- Size 549KB
- SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
- MD5 0b24892597dcb0257cdb78b5ed165218
- SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
- SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
- SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
- TLSH T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH