2acc9c45b929a171a16f506530db97f2107c722dac4bf4cf53afac36cbe2089a

Analysis

max time kernel
99s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
Size 2.8MB
Sample260825-h15g4stycw
SHA256 2acc9c45b929a171a16f506530db97f2107c722dac4bf4cf53afac36cbe2089a
MD5 9537b090db05e23a764e07e38ccc9409
SHA1 5c8ea298f50dfb0dc3e6afa1fbfb5bbf7d12a1b3
SHA512 0e7f7c0a7e956d33bf357eb0eb430dc9ed7fc4141a744280a004536401b419d76b85395b27be660c05d7e357bc7c2990e49b156584b847ee94a8671039f0c83e
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0Aj:yeUJF3noxDPhgjOk9WOljo
TLSH
T1F6D5AE12F7E48572E0734231C9EAA765E57A7C621B3086CB1398DA1C1F726D1BE36723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5820	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4588	2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
5820	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_9537b090db05e23a764e07e38ccc9409_amadey_darkgate_elex_luca-stealer_njrat_rhadamanthys_stop.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4588

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.8MB
SHA256 2acc9c45b929a171a16f506530db97f2107c722dac4bf4cf53afac36cbe2089a
MD5 9537b090db05e23a764e07e38ccc9409
SHA1 5c8ea298f50dfb0dc3e6afa1fbfb5bbf7d12a1b3
SHA512 0e7f7c0a7e956d33bf357eb0eb430dc9ed7fc4141a744280a004536401b419d76b85395b27be660c05d7e357bc7c2990e49b156584b847ee94a8671039f0c83e
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0Aj:yeUJF3noxDPhgjOk9WOljo
TLSH
T1F6D5AE12F7E48572E0734231C9EAA765E57A7C621B3086CB1398DA1C1F726D1BE36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.4MB
SHA256 75bb79a184ea38c6a3bee17d3dff213a30a8f119674825e0a064b5dcc4c81c60
MD5 9790c627d85c74495edb9a7758124651
SHA1 98ca54f45bf4a18afe736680ac4fb9b2d34648fd
SHA512 699ba56c956713b02a68890fdebdf1f1326b40df8db5fadc665449a615bb5f8c198cd7fe450c5b87c6638dd6c6e8b78735cf15c726b8531504a6f1795c5b05dc
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0AjKPji0Aj:yeUJF3noxDPhgjOk9WOljo0jo
TLSH
T12FF5AF12F7A48672E0738171C9E6A795E97678520B3086CB1395CB2C2F736E1AD36733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
Size 2.9MB
SHA256 c67263d94202f05cf52cb9b2a6277d7e68a2bede995dd7d4ae724138883a31c1
MD5 eb26220e6f9c712ec0ddac1062e37311
SHA1 59d471b3b6316540de29b261c6e622daa38a6c8e
SHA512 746caf4a098605f87ff892e90a452b6db6e6bd88651d1f0c3855b95de9b0774f804e380d355d95b9623b0fb927adc950319d2cf696b0462cbdfbb18b5d1abb12
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0Aj6:yeUJF3noxDPhgjOk9WOljo2
TLSH
T118D5AE12F7E48572E0734231C9EAA765E57A7C621B3086CB1398DA1C1F726D1BE36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DW20.EXE$

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
Size 2.9MB
SHA256 1814bf3f415d2bce1d33c5046cd36c64caedcf16862bad165f2fe1be51d91f0f
MD5 a7426b41f5c4ec97006e7f39c47d8294
SHA1 d92584f05ff2b8f02ac337885618d2225d2da17f
SHA512 e000a007106fbf76cbb7b8c612f3556af75d2e9ac2d42eaf25580cca20621faf6008224afbe3cbcebe969fa256d0af7517c37d4694fbf881a656bf7c2ae907fe
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0Aj7:yeUJF3noxDPhgjOk9WOljoX
TLSH
T1EFE5AE12F7E48572E0734231C9EAA765E57A7C621B3086CB1398DA1C1F726D1BE36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
Size 2.9MB
SHA256 48b0e8c7ea49c1345a317c4124405eb125f0d568fe840eaa15989445700dd431
MD5 d1b6b3326b7fdd069ecf926adc16b780
SHA1 9b29eaeb56a3a0ab6ce4adf834a7fa464d34d0df
SHA512 cdfb7f03bf5b6b10e005352c4c3056f36021cfc2109d13fb6f849f7464b8e9cfabe62173da9699f7f2e22b40f1e6272172b3591e106a96aff5678cf677a4420e
SSDEEP 49152:2pppppppvP8xmN3Aek03noj45wlDT0wnNTB4Igjdsk9WnO1Pji0Ajq:yeUJF3noxDPhgjOk9WOljo2
TLSH
T1DCE58D12F7E48672E4B34131CDAAA765E5797C620B3086CB1398BB1C1E726D1BD36723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4588-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4588-1-0x00000000005C0000-0x00000000005C3000-memory.dmp

Download

memory/4588-24-0x00000000005C0000-0x00000000005C3000-memory.dmp

Download

memory/5820-11-0x00000000007A0000-0x00000000007B0000-memory.dmp

Download

memory/5820-25-0x00000000007A0000-0x00000000007B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads