Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 00:42
Behavioral task
behavioral1
Sample
2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
- Size 6.9MB
- Sample260913-a2g47sch48
- SHA256 8b24c58f8143fbe33c076e888d0a40ab84352a32816af434f510a58bd37e1a79
- MD5 62bc108af6e189fc3948e58c038356d9
- SHA1 ed351619810cdf8679b613810010e2fb1659fea1
- SHA512 5f8eaefcf8de1a5758c80e14ccca8781b94f3dde0cca72da8cf0d5133157fbf063f21fdd6223bd1e9ec4ec293525d5d0af90ee0654e15982e9642b3f46a771ef
- SSDEEP 98304:3iifpIpxrXGxqvO/cPYxWJ1kAkVMybchI69v+DcEkhMUloJAy5M4l:rypFvqcAQuc6cv+DcEkhMuOAy57
- TLSH T12B764A027BE80025F5F327748A7E95549A7ABC620B38D5CF11882D9D0E73AD1AD36B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 18 IoCs
resource yara_rule behavioral1/memory/848-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-15.dat UPX behavioral1/memory/848-19-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-32-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-33-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-34-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-35-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/848-36-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\control.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe -
resource yara_rule behavioral1/memory/848-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-15.dat upx behavioral1/memory/848-19-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-32-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-33-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-34-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-35-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/848-36-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\r\TrustedInstaller.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\f\PickerHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\r\PeopleExperienceHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizardElev.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1_none_0990e3dd20dd5732\omadmclient.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\r\UpdateNotificationMgr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\rasphone.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrmUi.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\f\fixmapi.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\poqexec.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\bthudtask.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\ImeBroker.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\dmclient.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\f\SearchApp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\f\fontdrvhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFaultSecure.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1_none_c36f57b8a28f2fbc\msoobe.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\djoin.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\iissetup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\f\wslhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\SpeechModelDownload.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_e2f3aaf24de135ec\Magnify.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\WWAHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\f\MusNotifyIcon.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_4247919c34819e8e\pcaui.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.19041.1_none_4d9121ef47f5b52d\mshta.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandbox.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\ChsIME.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.19041.746_none_b4017de081b11e02\r\MDEServer.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\notepad.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\f\rundll32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.19041.1_none_b89a948362edb3e7\sapisvr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\WmiApSrv.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\r\wevtutil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\f\PasswordOnWakeSettingFlyout.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\r\Taskmgr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\r\DismHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\f\WpcUapApp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\f\ApproveChildRequest.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_19a36451bbe13a1c\SystemPropertiesProtection.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\wsmprovhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.1_none_a987c4762e046692\CertEnrollCtrl.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\f\AppHostRegistrationVerifier.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File opened for modification C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\MsSense.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\f\gpscript.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_60c397ff12ee4db1\w3wp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\f\wsmprovhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:848
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 9.8MB
- SHA256 0797dfa68318f76c908f022f01e4c631f6e472b68ed0d9075a1c0dd802b69f5d
- MD5 8db752ae380a9006d86342e75ce246fd
- SHA1 3dbc78a436dda26455d10126fcb7fe47cb9f55ea
- SHA512 dc60847160eb07421b1ebc33d230dbeacb37e0dc08c9208a9e5ecf6924d403905e49ad1f8380b43b90c3612b8eddd18fd64a42721f1212037fe147f4b6a0379c
- SSDEEP 196608:rypFvqcAQuc6cv+DcEkhMuOAy5KKhLajki:s1f6cv+DcEkhMuxy0Gi
- TLSH T1E5A67C02BBEC4064E5F352788A7AA915EA767C590B34D5DF01881D6E0F33BD1AE35B32
- MD5 SHA1 SHA512 SSDEEP TLSH