Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 02:19
Behavioral task
behavioral1
Sample
2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
- Size 6.5MB
- Sample260825-csct8swcmg
- SHA256 61c861409f8d731c463c239be81af1948ca675aeb937b708089784355ae71187
- MD5 bf5f894cbc512838fe7cbbbd7916726c
- SHA1 6a79412a619951d475c3c0486e4284daa04a64e1
- SHA512 828fa66653a6254a8489e311896612f6f340a69d38ae4fbe5bb46f250baaff9ba8446960f7f5dd45254e67c26901d42bb9e59f97c0c4e1bde2b7fb2f61a1e88c
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxXm:YPuQkNwnYBzzXm
- TLSH T19066B3022E8C5531DD6F3E305865A2B8F5547D6FBC2E791A2EC03E8DE6B38C1791D622
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe -
resource yara_rule behavioral2/memory/4244-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c51f-5.dat upx behavioral2/memory/4244-686-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4244-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\r\eshell.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\PasswordOnWakeSettingFlyout.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\mavinject.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_f6d6d78e8be62381\wlanext.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_57ca55906b66d7b3\SystemPropertiesPerformance.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\PhotoScreensaver.scr- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\r\RunLegacyCPLElevated.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\r\dxdiag.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\HealthAttestationClientAgent.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_22beb1f66a9bdcd9\ComSvcConfig.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\LockAppHost.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\sort.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseTVM.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1_none_0255f59a11a05209\wecutil.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.26100.1591_none_482bc815c9162047\r\dusmtask.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\r\msconfig.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.26100.1_none_c842a966f62dd0c5\FirstLogonAnim.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\mpextms.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1_none_b7f01667e525edde\dcomcnfg.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.26100.1_none_b6996f0c07fabc7a\SMSvcHost.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\winhlp32.exe 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\directxdatabaseupdater.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\pcalua.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\r\TokenBrokerCookies.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\lodctr.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchFilterHost.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\IMCCPHR.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_460eda816899b508\dsacls.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_d691427f65d1362f\aspnet_regsql.exe- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\IMEPADSV.EXE- 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_bf5f894cbc512838fe7cbbbd7916726c_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.5MB
- SHA256 0f92e0854e5560c57ead34a02f66400aa6f1cab4d499792a575047c0013545f7
- MD5 32ed550f7a3b1dfb31ec220cab9f50be
- SHA1 aa8aa2a9eda3fdfac8f31e78f6b29c9bbfadfd91
- SHA512 ef30f317c607680da774da2fb92d5e6e8d0045c8f50c0b3a62bb45c0029a72b50903b06afe548347ab735b356166a9ebe61016d117af09cb83086b2782f9b66b
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxXvezSC6v2XMHn:YPuQkNwnYBzzX0E
- TLSH T11186D5026E5C5631DC6F3E304861A2B8F5613D5F7E2E791A2EC03E5DEAB38C1752D622
- MD5 SHA1 SHA512 SSDEEP TLSH