Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 00:19
Behavioral task
behavioral1
Sample
2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 16.7MB
- Sample260913-amfmtsce75
- SHA256 0b63878c7a0e8ee5da4797e18f0af9ce0d7e1e9f6f76a8d09e5b9536e685b433
- MD5 66f9f53363c2c06a6d34683b103090eb
- SHA1 7fba0aea0e0fc8efe8e635117d814c004f03e464
- SHA512 239e5060a250537b69790cbc0e75cce17c0877a029477fff9749c4a58e1868ccf07676d31e2d90accb63441bc498fa686fc3c9b4f7e9d7257d9baaab2d1d2857
- SSDEEP 393216:Tf6cv+DcEkhMuxySIbUwF1VERmj2b0JhllNUHGcgUVluK7aH:Tfxv+DcEkhMux1IY092bO16HvfVlu4o
- TLSH T1B307F101FAC741B2ED53153015ABF22B5B3466138728CECBF94C5A49EF33AE2593476A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/2000-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2000-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certreq.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\comp.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\resmon.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\winver.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\proquota.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/2000-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2000-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\r\bootsect.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\r\Dism.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\r\dxdiag.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\eshell.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\r\gpscript.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\LanguageComponentsInstallerComHandler.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpshare.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1150_none_b5750378d5419664\fltMC.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\DsmUserTask.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVShNotify.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.26100.1_none_b07834d22711b2d0\cttune.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\EASPolicyManagerBrokerHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\charmap.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\PresentationSettings.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\r\psp.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\r\SystemUWPLauncher.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_c99b7f92812c4030\iexplore.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\vmplatformca.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\LockScreenContentServer.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.26100.1150_none_d9f89d43802b0109\bootim.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_51450313e3636a10\r\certutil.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\r\dsmgmt.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\r\OOBENetworkConnectionFlow.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_7da6e7654a833d6c\PeopleExperienceHost.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVShNotify.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.26100.1_none_a7bc2b43865e8120\fsavailux.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\r\PrintDialog.exe 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_66f9f53363c2c06a6d34683b103090eb_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2000