Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 20:43
Behavioral task
behavioral1
Sample
2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 15.5MB
- Sample260910-zhktesef57
- SHA256 829a22d292e34ed6e33e7980e4dfaea70130b9047be192d54c4201b87aba03eb
- MD5 027f336d662da45645635b9de937209c
- SHA1 c81b796ec76ff5e5aedcac712a76a7cf6e4862b0
- SHA512 876b355727e055b3161edbd01c18db16166431b552cfc9cd587cd3671eab2417d5d3dc8dba5c8ce2aab61d3c48801c70d5036f8eda80581db8cdeac05730d898
- SSDEEP 393216:a+3f6cv+DcEkhMuxySIbUwF1VERmj2bXIbUwF1VERmj2b:Rfxv+DcEkhMux1IY092bXIY092b
- TLSH T175F61222B6D55036E5B3263019BDA3315ABA7DB11B39C6CF03840A5D0EB2E91AD38777
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/3304-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3304-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskusage.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\findstr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\where.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\choice.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mmc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\user.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/3304-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3304-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\r\setupugc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\ntoskrnl.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\WpcMon.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFCompanionHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\r\proquota.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\r\Windows.Media.BackgroundPlayback.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\aspnetca.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\repadmin.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\r\WorkFolders.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\r\nfsclnt.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_a2d78d0e147c4763\aspnet_regsql.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\CredentialUIBroker.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\r\extrac32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\r\SystemSettingsAdminFlows.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvix64.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\r\fixmapi.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\r\logagent.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\r\GenValObj.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\r\securekernel.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\r\wmprph.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\RecoveryDrive.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.26100.1591_none_b67e058f470e99bc\r\SystemSettings.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-10_027f336d662da45645635b9de937209c_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3304