Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/09/2026, 02:07
Behavioral task
behavioral1
Sample
2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
- Size 6.5MB
- Sample260908-cj55esyths
- SHA256 ad939ebb653b99d2fe4a399c1028f68e92bdb12b6f7d458d78703a90726e1cdd
- MD5 ee38f36934e22035ac705bb42b3de8df
- SHA1 b5591d14b04987af2fdb5df48adc7588889015e5
- SHA512 6d5a56032fef3bc78b1e641e8def7ea6986ce19d767e1422db3b790ebaceb5721f77996d09502b06bbe97fb88d02ac655543980d7b2fd43aa72d5777915fe52c
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxX1:YPuQkNwnYBzzX1
- TLSH T13C66B3022E8C5531DD6F3E305865A2B8F5547D6FBC2E791A2EC03E8DE6B38C1791D622
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdl32.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\logman.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\fc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\tree.com- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\proquota.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\runas.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe -
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000c000000024269-5.dat upx behavioral1/memory/2180-848-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2180-3216-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\winload.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\r\WMIADAP.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\mofcomp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\f\DataExchangeHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\wermgr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\f\wpr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_c12e5c6c2037e719\imjpuexc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\runonce.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\SystemUWPLauncher.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\LaunchTM.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\f\gpupdate.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvax64.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\f\notepad.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-add.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Boot\PCAT\memtest.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\r\wecutil.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\lpremove.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\WmsUserAgent.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\r\control.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.1_none_e2f75fda217d5015\hvc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\aitstatic.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\f\Magnify.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\r\IMESEARCH.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\CCG.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\r\lsass.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\f\SecHealthUI.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDriveSetup.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_3626754ec37c229b\RmClient.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\tracerpt.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\f\rdpclip.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_cb8306be5498a914\imjpuexc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.928_none_0f531ea0d233243b\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\MdmDiagnosticsTool.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgusr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\r\LaunchTM.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_0d475c3f57a2ce2b\at.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\AxInstUI.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.844_none_c0d0cb934c1c1f17\f\DTUHandler.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\f\LockScreenContentServer.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.19041.1_none_8b6323099e7e4441\aspnet_regiis.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchFilterHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_76ab6db74ef1e15e\waitfor.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1_none_35d43a0ec2872060\SettingSyncHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.1MB
- SHA256 87afaa2c28bf48157542562c8087d8b1b846833afcd27e39c647cbee33d0631f
- MD5 d56734eb1b00f90ffa11730de7dac3d5
- SHA1 8c5cd6ae1f1b4cd5171aed5d4b439fdf60aedc42
- SHA512 e452c4d3426937789808d0ed3062e6297ab38ca226328154136b5303be6d3d49f39692ad546b09e3a809925fba3d6aac0bcbd12996cde4118fc05c2ef08adaa2
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxXRjow:YPuQkNwnYBzzXVow
- TLSH T1DD76D4022E8C5631DD6F3E305861A2B8F5647D5FBD2E791A2EC03E4DEAB38C1751D622
- MD5 SHA1 SHA512 SSDEEP TLSH