Analysis
- max time kernel
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 16:27
Behavioral task
behavioral1
Sample
2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 15.7MB
- Sample260913-tygh2ssths
- SHA256 e8cf9d2abcab2b1e8783d82854f69c6ff857c95b7da41eaf98b1c6f245bd5b36
- MD5 339d36803282b07117998ed7d2c0f7b6
- SHA1 f463cf34a50aa75e501afa047030c384a59597d8
- SHA512 63f0b3a4d9beca621ab1d62cf4dba7831820f8fa050a1b0e1dfc443cc137935631666acada2d2c6c662fab1c79abb839020d2613e1d810b4895e5a22e5968c44
- SSDEEP 393216:rvRJhllNUHGcgUVluK7aMIbUwF1VERmj2b:rvj16HvfVlu4nIY092b
- TLSH T1A5F60100FAC700B1E867547056ABF22F5B3861038718DED7FA8C5A85EF23AE25D3575A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral1/memory/5260-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-16-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/5260-18-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\label.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\comp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\choice.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\svchost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sort.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\net.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\help.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\secinit.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\newdev.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\relog.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\user.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral1/memory/5260-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-15-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-16-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/5260-18-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.SyncController.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\r\services.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\r\prevhost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\r\InputSwitchToastHandler.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\r\nltest.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.19041.1_none_00c2b5589b88ca78\iediagcmd.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\r\ntprint.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PATHPING.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\f\SystemSettingsRemoveDevice.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\sethc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\f\WindowsSandbox.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\logman.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\changepk.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\CredentialUIBroker.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\r\tcblaunch.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\wextract.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\f\tcblaunch.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.84_none_7c1f17a9e1beaf63\r\recdisc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_b5fe9c5c09b9d7a9\f\rundll32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\HelpPane.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.264_none_39a33f9dfdb389ae\slui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\r\ntoskrnl.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\imecfmui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\nltest.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.1_none_cc694aafc259f133\sihost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.19041.1_none_856b4f50911c6560\DmOmaCpMo.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\r\Magnify.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrm.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\SpeechUXWiz.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\f\CloudNotifications.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.19041.1_none_55cbbe2f0b32a503\credwiz.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\f\LanguageComponentsInstallerComHandler.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\unlodctr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.19041.1_none_d0dbd55ec26928c1\GenValObj.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\nvspinfo.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.1081_none_bdf809eb2dd695f9\AppVClient.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\ndadmin.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\f\PerceptionSimulationService.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\IMEPADSV.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\FileHistory.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\r\isoburn.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\CameraBarcodeScannerPreview.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\f\lpksetup.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\bash.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\r\Microsoft.AAD.BrokerPlugin.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\r\nltest.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\r\DataStoreCacheDumpTool.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\r\sppsvc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_ceb3891c2721fc43\chkntfs.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.19041.1_none_0b147d237ce650c5\forfiles.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5260