Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 05:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
- Size 3.4MB
- Sample260913-gpmbqaff99
- SHA256 9b641c978779892fd4dff45c4daf162c8f9fe3976df03bd69cb671129319c861
- MD5 16a47934315b911c36ea5d69f6fe0920
- SHA1 061d95b7ad8ba2044aad94e1c80cc928b9333ff2
- SHA512 bc4b5d8407de85a932479effb540a7d13e2fd5aec3b6c81109b6d77156a4eef5367f0740121a0a27d8f2f00b288a528b18c3898e97bed797709986db39a5448f
- SSDEEP 98304:s/vN1SERbmhT227p+ZuoDtFDp4Z/X8SVLFC/KnfzNg1mPvKQ2jptOjt6Wq6wvkfn:vhT227p+VDtj4Z/X8SxFC/KnfzNg1mPL
- TLSH T1C7F58E00FBCB40F2D967093044A7F32F5B35A602C524CF9EFA9C1A59EF33662592576A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\icacls.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\proquota.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\find.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\compact.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\regini.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\calc.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\print.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\control.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\r\RunLegacyCPLElevated.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\LogonWebHostProduct.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseAP.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\LaunchTM.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.26100.1_none_baccdf245b7274cb\cttune.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\r\msdt.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmproxyd.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.26100.1150_none_de2664616a7b438a\OOBENetworkCaptivePortal.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\NgcIso.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCmdRun.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\r\DisplaySwitch.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\wermgr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_a7d95898a02bb485\aspnet_wp.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.26100.1150_none_68a5bbed8a1f4ed6\uwfmgr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1_none_f288deea5ef6349f\logagent.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\pcaui.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasdial.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\UCPDMgr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\r\omadmclient.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\bash.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\r\bash.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\RecoveryDrive.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_f29d806b561540f6\ngen.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\ImagingDevices.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\r\StartMenuExperienceHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1150_none_b5750378d5419664\fltMC.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\r\ShellHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_931673d5fd963a61\driverquery.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPDCT.EXE 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthService.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\IMCCPHR.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\r\aitstatic.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\svchost.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\reset.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\r\PrintBrmEngine.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.26100.1_none_6ea9e81d0ca2fc8b\DataSvcUtil.exe 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_16a47934315b911c36ea5d69f6fe0920_amadey_darkgate_elex_glassworm_luca-stealer_njrat_redlin.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2864