Analysis
- max time kernel
150s - max time network
110s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 21:50
Behavioral task
behavioral1
Sample
2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
- Size 14.3MB
- Sample260912-1pyvasgk2x
- SHA256 a337ef42ffb489140e78680731ea259433136d9d0215b76926a83b1fbfd8675e
- MD5 8c1125d921d420cbe666365e729eb758
- SHA1 29be2ea18b7d10915cbdb38b912aaa5c8f2ecf3e
- SHA512 4ba109e823a27fa472aecc6e6bf2c3b087e4dacbb0b31b16673bb966742d2c50dd0388080f322c96d924f2bfb8eb7c593304633f50c45c59878574bc30a26f87
- SSDEEP 196608:TB3JWB3J5B3JWB3JYeGZF6bUpMBF1p/kjRm4OWi2b:TB3YB3vB3YB32IbUwF1VERmj2b
- TLSH T12DE6D01177D08136E4B356B05AB9A2716BBABD212B31D78F2389276E1E307C09F3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3192-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\OposHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ftp.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\at.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msdt.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\sort.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\user.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\where.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe -
resource yara_rule behavioral2/memory/3192-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3192-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\r\la57setup.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\WpcUapApp.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\HelpPane.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\r\NDKPerfCmd.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\wscript.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\containerworker.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\RuntimeBroker.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\mount.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.26100.1_none_6286baeedbc54537\LogonUI.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\DiskSnapshot.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tskill.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\r\consent.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\cscript.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\r\directxdatabaseupdater.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\r\AppResolverUX.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmUi.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\LsaIso.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\IMESEARCH.EXE 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\r\IMESEARCH.EXE 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\r\verifiergui.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpremove.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\r\RdpSaProxy.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5542cd086dc867d0\cacls.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2271a765c49d2684\taskkill.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\r\GameBarPresenceWriter.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_7da6e7654a833d6c\PeopleExperienceHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\StartMenuExperienceHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\SysResetErr.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ARP.EXE 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\r\ApplicationFrameHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_ec48597b611b680a\systeminfo.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.26100.1_none_ded6253deae5fdf0\dnscacheugc.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_8c1125d921d420cbe666365e729eb758_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3192