Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 03:07
Behavioral task
behavioral1
Sample
2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
- Size 10.4MB
- Sample260913-dma9wsec93
- SHA256 3d8b2386f27a2ce7e33a5badea035f2039c9dbf0f239d19aa0b9e42e7a68f03a
- MD5 3f30bfbfdc9b494e22c8ef0af6e626a6
- SHA1 697aaf39d2a1af81e7f8f05b3ffc774e6c797a9d
- SHA512 3a232897a265e80da474d755b6c292ed667c26f64344ca406a36b9a0783da2371b336c5549ca15c86cba55b0c408f4bdc132395836c740588b2d409b5dc51875
- SSDEEP 98304:MUsrUsYFJVUsrUsYFJWUsrUsYFJVUsrUsYFJZPWEAPOjA3Xy/wkidOYajQ7j9:TB3JWB3J5B3JWB3JZPWEcOjAHy/w8S
- TLSH T17BB69D1177D08136E4B327705AB9A2616ABABD716B31D78F6388276E1E307C0DE35327
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 17 IoCs
resource yara_rule behavioral1/memory/3852-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-16-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/3852-17-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-19.dat UPX behavioral1/memory/3852-26-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\resmon.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\setup16.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\userinit.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wextract.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ftp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\certutil.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\control.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\secinit.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe -
resource yara_rule behavioral1/memory/3852-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-15-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-16-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/3852-17-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-19.dat upx behavioral1/memory/3852-26-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\f\Microsoft.AAD.BrokerPlugin.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\f\XblGameSaveTask.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\iisrstas.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpconfig.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\change.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\ScreenClipping\ScreenClippingHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\autoconv.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\comp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\r\gpupdate.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\r\pcaui.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\r\wbadmin.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_ce6643a69c39f80a\ThumbnailExtractionHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.19041.1_none_0cfdc32c8765ead4\LinqWebConfig.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\f\vmcompute.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_92d880487c3589c8\cmdkey.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\r\phoneactivate.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\UserAccountBroker.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\r\WaaSMedicAgent.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-keygen.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\CCG.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\csrss.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\r\WorkFolders.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\Microsoft.ECApp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.1_none_d7372edf29e45655\LanguageComponentsInstallerComHandler.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\f\notepad.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\DataUsageLiveTileTask.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\SecHealthUI.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\f\DataStoreCacheDumpTool.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\DTUHandler.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.19041.1_none_579ae2e26c347896\WMIC.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\f\FileExplorer.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_a5a5fe7757df26e3\NcsiUwpApp.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrm.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\r\nltest.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.19041.1_none_857c0c60dec56103\snmptrap.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\SystemPropertiesRemote.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\f\sdbinst.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\msinfo32.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\MsSpellCheckingHost.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_1a55178fad503598\ttdinject.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\r\WmsSelfHealingSvc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1_none_e9b79397c28488a5\pcalua.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_ed6c95dcd471837f\r\mmc.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.1_none_81f73568e4ce1819\DeviceCredentialDeployment.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\ResetEngine.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_d4039dd5692796db\ngentask.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmLpac.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\r\cmd.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\f\bash.exe 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_3f30bfbfdc9b494e22c8ef0af6e626a6_coinminer_darkgate_elex_memery_rhadamanthys_smoke-loader_stealc_tofsee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 13.3MB
- SHA256 d8147b6d1c0978594df5a4f5afb167701ef02e1e87a29e3e7312a5bda3653066
- MD5 5b153055cd5c7aebd0bc5324a8249753
- SHA1 c4a7c19182e8334a6844b46b18bb61e5294ba390
- SHA512 b42b3f1fda5ec90ab4e891ffa735aea7eeff8121b85de971bf84147986de4e8c228c9126cb5ad2cd76e5e35820ce2772bbb5d37a18add4f0d1391fd45ece9fc8
- SSDEEP 196608:TB3JWB3J5B3JWB3JZPWEcOjAHy/w8lKhLajki:TB3YB3vB3YB3bWEvqy/jlGi
- TLSH T19CE6AE1177E48075E4F392744A7AA221EABABC295B31D7CF1384676E1F327C09E35326
- MD5 SHA1 SHA512 SSDEEP TLSH