Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 14:19
Behavioral task
behavioral1
Sample
2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
- Size 4.2MB
- Sample260912-rmyl3sydnf
- SHA256 9e8ff49c1ef290e026c0b9c881e5b36a9bd8847e725ddcfa40995e931c8f8fc5
- MD5 fb2a573293942f39969afb22d34bcfe8
- SHA1 a8f152813082cfa15b02c3dda39658d4aca83e10
- SHA512 98267b7ec2736af8bd6db743690cd690358c70fdcd3793f97424a1f6ddf8a28dc77cea2cc7759f0b2302ce42faa1d7535ab3fc59f79eae5ee75fe9b55b861e30
- SSDEEP 49152:82xzU6l0S7PLjeTVDPkB5FREPtAxrCcGU8+kB4gb3OP1m8vPHve/idPYuAbRlmZK:xxf7PL+IpxrXGxqvO/cPYP
- TLSH T17E16F60267EC0468F5F36B388A7A89509A37BC560B34D5DF0298195E0F73BC19E76B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 11 IoCs
resource yara_rule behavioral2/memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3428-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\hh.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/3428-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3428-11-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setx_31bf3856ad364e35_10.0.26100.1_none_b3bf2881b5fdbf6e\setx.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\r\fixmapi.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\r\Robocopy.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1695d375c2f4d597\ServiceModelReg.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\r\WinSAT.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\r\WmsSelfHealingSvc.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1_none_bf65878ace780f5e\shrpubw.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\DWWIN.EXE 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\r\MsSpellCheckingHost.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\rwinsta.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_ddc589fe5044ffed\MSBuild.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.26100.1_none_06a70fed9a123232\WSCollect.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_d8607d8709732f01\InstallUtil.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\r\colorcpl.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\r\UsoClient.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_75598f0af79da90a\aspnet_compiler.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\r\WindowsActionDialog.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\r\IMCCPHR.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.26100.1591_none_b67e058f470e99bc\r\SystemSettings.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\mpextms.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.26100.1_none_a0f668eccd5513ba\SMConfigInstaller.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\r\vmplatformca.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\cleanmgr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\r\CompatTelRunner.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\powershell_ise.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_2ce74853de1f47d4\raserver.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1_none_e271ed51a0d2c02e\extrac32.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1150_none_9f6738de73cf4ce3\dpnsvr.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\r\mspaint.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_9f891aedaabbca5a\ilasm.exe 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_fb2a573293942f39969afb22d34bcfe8_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3428