Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 17:14
Behavioral task
behavioral1
Sample
2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
- Size 15.4MB
- Sample260912-vr22vafa48
- SHA256 3e3d715866580184b852d461b94cbbfdeb220e8fabfffa5e0105a1b36f300f17
- MD5 cfd4c7154dcb2e8e81942f77a6b602f7
- SHA1 53717bdabb2128c3d58e18da5dfca53b7e400d8b
- SHA512 e9609d3ebf40c421a625b3240e742de7a973e752c7f39a293095ee8ec76b24a1ca55afb1c729202c71a751bdc1608bed79b31e391dedba134d52114d567a1f49
- SSDEEP 196608:TBWQKBWQbBWQKBWQpeGZF6bUpMBF1p/kjRm4OWi2b:TBJKBJbBJKBJNIbUwF1VERmj2b
- TLSH T11FF6E12277D08036D0B311719AB5F7216AFABC316B31D6CB63895B3D1E713D09A3936A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/3456-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3456-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\expand.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\icacls.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\recover.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\mshta.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\winrs.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe -
resource yara_rule behavioral2/memory/3456-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3456-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\FileExplorer.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\cliconfg.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\r\msinfo32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_5d5870c25fd0c1ea\netbtugc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\colorcpl.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\DsmUserTask.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\BootExpCfg.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqsvc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\odbcad32.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\r\cmd.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\r\CCG.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\r\WorkFolders.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\r\ftp.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\r\ByteCodeGenerator.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandbox.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\r\rekeywiz.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\r\dccw.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\r\PackagedCWALauncher.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\WpcTok.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\r\SndVol.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\wpr.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\fontview.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\cttunesvr.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_ca90d4b7666bc2e5\r\appidtel.exe 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_cfd4c7154dcb2e8e81942f77a6b602f7_coinminer_darkgate_elex_glassworm_luca-stealer_memery_nj.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3456