Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/09/2026, 02:07
Behavioral task
behavioral1
Sample
2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
- Size 6.5MB
- Sample260908-cj55esyths
- SHA256 ad939ebb653b99d2fe4a399c1028f68e92bdb12b6f7d458d78703a90726e1cdd
- MD5 ee38f36934e22035ac705bb42b3de8df
- SHA1 b5591d14b04987af2fdb5df48adc7588889015e5
- SHA512 6d5a56032fef3bc78b1e641e8def7ea6986ce19d767e1422db3b790ebaceb5721f77996d09502b06bbe97fb88d02ac655543980d7b2fd43aa72d5777915fe52c
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxX1:YPuQkNwnYBzzX1
- TLSH T13C66B3022E8C5531DD6F3E305865A2B8F5547D6FBC2E791A2EC03E8DE6B38C1791D622
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mobsync.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\comp.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\find.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\curl.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\calc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\more.com- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\control.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\subst.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe -
resource yara_rule behavioral2/memory/6188-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c625-5.dat upx behavioral2/memory/6188-638-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/6188-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\r\logagent.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\AppHostRegistrationVerifier.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_a9f439dd812975b1\wusa.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchFilterHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\WMIADAP.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskraid_31bf3856ad364e35_10.0.26100.1_none_627d4c710086cc28\diskraid.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_65fa7713b81f7fd0\aspnet_regbrowsers.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\r\BrowserCore.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\charmap.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1_none_1d7ec919ce94ac2f\winrshost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15912.0_none_5cfe50bb9b6405ea\DataSvcUtil.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_af4d21cdb9ffe687\mountvol.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizardElev.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\diskperf.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_04bcf928bfc9ab50\jsc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\CustomInstallExec.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_10.0.26100.1_none_578d9d3a73cfb479\mblctr.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\pacjsworker.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\r\LockApp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_6eba2dc7c1074207\aspnet_regiis.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\Microsoft.ECApp.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpCmd.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_0e2538fcfbcfdda3\r\certreq.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\mmgaserver.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\chkdsk.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\notepad.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_6a3dfd5b91399bfb\xcopy.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\r\winload.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\CustomShellHost.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\tabcal.exe- 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-07_ee38f36934e22035ac705bb42b3de8df_amadey_coinminer_darkgate_elex_luca-stealer_njrat_smoke-loader_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.5MB
- SHA256 3521747a033826437fb08a34199260ae73a36c514e363e24d836abe0ee79a5cb
- MD5 3e8335df784f0cf1bc396dd4c4d1806b
- SHA1 fd82458016e48b47dfaedf6fc23b670b2896a3be
- SHA512 cda4a1b0c2620f710027b4383d0037dce539de2deb0cf43458683e4c084a6618fc4d56fc3058276b54868da812fef45672d25d344561339f7e38c02dfd544e4f
- SSDEEP 98304:fgAIabjKoh9Ws3JdXN0B7+sTIDQkN8f01iuciNu2zPnj/7pxXKezSC6v2XMHt:YPuQkNwnYBzzXha
- TLSH T1C486D5026E5C5631DC6F3E304861A2B8F5613D5F7E2E791A2EC03E5DEAB38C1752D622
- MD5 SHA1 SHA512 SSDEEP TLSH