Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 11:32
Behavioral task
behavioral1
Sample
2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe
- Size 16.2MB
- Sample260825-nnnlqa1epd
- SHA256 248cf2d7f18a8894130b1482f5d26521237d336d2c06b4eb7d1345f8b29c15cc
- MD5 667038a1dd85e25fa932d360c8d6aef2
- SHA1 2ba91036afa6c2f2a3bc186ce2f685ade5e92c36
- SHA512 aea44ea884c191db2014070b3adc3925a787d28c59af980a950b797199a4937590d214efc2f60f550d376f90316bcabd444a0b5481217eb61d991acd4a482a55
- SSDEEP 49152:HErF/N9YPlbIW8TJKrAWo3n2bjlJ+MYu8m1/N9hGtxaFoJJ8y5MI8boQhfD6UDvz:UNaTgxK8mzH838fDmZtLK3BDhQPjot
- TLSH T1390718436E5C45A9C8AF6E304954D36ADB217D046A225A8BB9CC7F9EFF721D07D28330
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\curl.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe -
resource yara_rule behavioral2/memory/5592-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c4e4-5.dat upx behavioral2/memory/5592-371-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5592-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2cc651b7f8fde87f\taskkill.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.26100.1150_none_7a6e656d581b85dd\Pester.bat- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\regsvr32.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\HOSTNAME.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\r\printfilterpipelinesvc.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_965fa19e130a6ef2\control.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_10.0.26100.1_none_578d9d3a73cfb479\mblctr.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1591_none_324c8f3af62cc63f\r\dtdump.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\dvdplay.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.26100.1_none_7cf949ca46b06d03\setspn.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_217b48412b560e3f\aspnet_wp.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\rdrleakdiag.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\SysResetErr.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1150_none_24e2f2e0c4c87239\wimserv.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\EoAExperiences.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\r\ntoskrnl.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_662e67cdd2014bd1\r\MuiUnattend.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpshare.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2f8b84e3f73f010f\tasklist.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.26100.1150_none_7019bb1b23bac3e2\Pester.bat- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_9dcb4fe8bf21aec2\RegAsm.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\r\hvsiproxyapp.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\poqexec.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_f9312521dc249ba4\WFServicesReg.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmimageworker.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\LanguageComponentsInstallerComHandler.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1_none_34b3c72fc640281d\DismHost.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpinit.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_667038a1dd85e25fa932d360c8d6aef2_amadey_darkgate_elex_remcos_rhadamanthys_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.1MB
- SHA256 b7b055d4b4d80d434c901483b63579fac7dc7ebc7fd860f89e33222f1e8c4d79
- MD5 ae9fc7f07c0042805b963a0f538c3536
- SHA1 9f59b67191c9025d879fd9cacf7796c04d29183f
- SHA512 1ec5506522d65fc20e8680cb6fabc09a3c911b792e82837e61aa4eafcada6f0029fb8a231ed24ab9a9e069eb8ab30f42df23ff6cd73ff7a05c5a608d605972e6
- SSDEEP 98304:UNaTgxK8mzH838fDmZtLK3BDhQPjoSezSC6v2XMHG:fT5QQByboZN
- TLSH T1F40717436E5C4569C8AEAD308854D76AEB217D046B225A8BB9CCBF5DFF721D07D28330
- MD5 SHA1 SHA512 SSDEEP TLSH