Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 14:28
Behavioral task
behavioral1
Sample
2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
- Size 15.3MB
- Sample260912-rs66eaan3w
- SHA256 6fb81c559fe6f22f5db8139a868704a3a6a0ca8c0e141c64b503d9f6f978eaa0
- MD5 f9c28d6e79749dfef4bed2a4453928cd
- SHA1 ce8c4b0ae61648f0a805a8525fa625dc4edae605
- SHA512 692805fe63b9ebfa043e905be514f8586c1dec2acbae842c7826e9becabb71c84e24db14a0dc7f95a32a3f4472d9b2152f8d3aa791f9661e6b9db5c48fa3c1a2
- SSDEEP 393216:04IbUwF1VERmj2b0JhllNUHGcgUVluK7aH:04IY092bO16HvfVlu4o
- TLSH T1D9F60141FACB40F1E853543056A7F32F2B349103C618DFD6F94C9A45EF636628A397AA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/1668-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/1668-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\calc.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msdt.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\help.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\sc.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe -
resource yara_rule behavioral2/memory/1668-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/1668-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\r\findstr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\r\curl.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\r\netcfg.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1150_none_b60d35260c7b5db5\sdiagnhost.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPDCT.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\IEChooser.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\PerceptionSimulationService.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\regsvr32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\r\DeviceCredentialDeployment.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\msinfo32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\kdnicctrl.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\r\winresume.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\HealthAttestationClientAgent.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1150_none_73d27b280bfbc7a7\iscsicpl.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\FsIso.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\aitstatic.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\r\hvsiproxyapp.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\plasrv.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\EASPolicyManagerBrokerHost.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\r\OpenWith.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsvworker.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\msra.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\r\ComputerDefaults.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\ChsIME.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_f9c28d6e79749dfef4bed2a4453928cd_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1668