Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 20:43
Behavioral task
behavioral1
Sample
2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 15.5MB
- Sample260910-zhktesef57
- SHA256 829a22d292e34ed6e33e7980e4dfaea70130b9047be192d54c4201b87aba03eb
- MD5 027f336d662da45645635b9de937209c
- SHA1 c81b796ec76ff5e5aedcac712a76a7cf6e4862b0
- SHA512 876b355727e055b3161edbd01c18db16166431b552cfc9cd587cd3671eab2417d5d3dc8dba5c8ce2aab61d3c48801c70d5036f8eda80581db8cdeac05730d898
- SSDEEP 393216:a+3f6cv+DcEkhMuxySIbUwF1VERmj2bXIbUwF1VERmj2b:Rfxv+DcEkhMux1IY092bXIY092b
- TLSH T175F61222B6D55036E5B3263019BDA3315ABA7DB11B39C6CF03840A5D0EB2E91AD38777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/4340-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-16-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-17-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4340-18-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cipher.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\makecab.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\replace.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\where.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mshta.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral1/memory/4340-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-16-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-17-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4340-18-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\WmsUserAgent.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.19041.1_none_13a24884d12d6915\vmplatformca.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_bafc9f61651f37d2\SystemUWPLauncher.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCLNWZ.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\EASPolicyManagerBrokerHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorQuickStart.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\ScriptRunner.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\lpksetup.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftPdfReader.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\Narrator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\r\klist.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirdpclient.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\f\LsaIso.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\r\smartscreen.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\f\TrustedInstaller.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_0e6389fff73df783\expand.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\spoolsv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\AxInstUI.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\autoconv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\recdisc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.1_none_b0876c2e7a0b3a5f\SpaceAgent.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_686405dc140529cf\schtasks.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\rasautou.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\WSManHTTPConfig.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_13c446a37d881982\where.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-keygen.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirpcd.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1_none_d374a4c62c9f2643\LegacyNetUXHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1_none_40c3733167c0c0bd\wpnpinst.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\f\MusNotifyIcon.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmproxyd.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\f\Defrag.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_c564589414ffc535\mmc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\r\nfsclnt.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\f\pnputil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.19041.1_none_625cda72b86ccf7e\dusmtask.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSSVC.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.19041.1_none_6db5d09458d426f5\wmpnscfg.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\f\SyncHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\pcaui.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.19041.746_none_e540b68b09558f5a\r\LockScreenContentServer.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\r\winresume.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.19041.572_none_bfb752f1e1449c59\r\dnscacheugc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.19041.1_none_f7adca24b5f66134\EhStorAuthn.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\f\gpupdate.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.153_none_e23c926e32d07dc1\hvsiproxyapp.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\f\AgentService.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SecureAssessmentBrowser.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_a541e711f3b2a478\mobsync.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340