Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:42
Behavioral task
behavioral1
Sample
2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
- Size 6.9MB
- Sample260913-a2g47sch48
- SHA256 8b24c58f8143fbe33c076e888d0a40ab84352a32816af434f510a58bd37e1a79
- MD5 62bc108af6e189fc3948e58c038356d9
- SHA1 ed351619810cdf8679b613810010e2fb1659fea1
- SHA512 5f8eaefcf8de1a5758c80e14ccca8781b94f3dde0cca72da8cf0d5133157fbf063f21fdd6223bd1e9ec4ec293525d5d0af90ee0654e15982e9642b3f46a771ef
- SSDEEP 98304:3iifpIpxrXGxqvO/cPYxWJ1kAkVMybchI69v+DcEkhMUloJAy5M4l:rypFvqcAQuc6cv+DcEkhMuOAy57
- TLSH T12B764A027BE80025F5F327748A7E95549A7ABC620B38D5CF11882D9D0E73AD1AD36B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2980-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\eventcreate.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\sort.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\user.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\calc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\findstr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\print.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe -
resource yara_rule behavioral2/memory/2980-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2980-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\mofcomp.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1_none_5449f71c20d1e235\at.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\r\recdisc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\r\Setup.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_18d76879146fa99e\TabTip32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_f51d83e935d81a1d\aspnet_regiis.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpresult.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_78ce8a6e35a89ad2\csc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.26100.1_none_21e4bd199d160d30\AddInProcess32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\EASPolicyManagerBrokerHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\r\NDKPerfCmd.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\r\prproc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\r\mspaint.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\UpgradeResultsUI.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\r\regedit.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\wextract.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\SpatialAudioLicenseSrv.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\mmgaserver.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\LsaIso.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\r\XGpuEjectDialog.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UpdateNotificationMgr.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1_none_bd6260d3acab64a7\ieinstal.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_75598f0af79da90a\aspnet_compiler.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\Defrag.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\fodhelper.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\printfilterpipelinesvc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchIndexer.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_bb53ccdac90dda7a\RegAsm.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.26100.1_none_2122cf9edbab3972\dmcfghost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_f151d0f42c5c742e\comrepl.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1_none_f4516e08d8dbd686\w32tm.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\ApplySettingsTemplateCatalog.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchProtocolHost.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_62bc108af6e189fc3948e58c038356d9_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memer.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2980