Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 16:27
Behavioral task
behavioral1
Sample
2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 15.7MB
- Sample260913-tygh2ssths
- SHA256 e8cf9d2abcab2b1e8783d82854f69c6ff857c95b7da41eaf98b1c6f245bd5b36
- MD5 339d36803282b07117998ed7d2c0f7b6
- SHA1 f463cf34a50aa75e501afa047030c384a59597d8
- SHA512 63f0b3a4d9beca621ab1d62cf4dba7831820f8fa050a1b0e1dfc443cc137935631666acada2d2c6c662fab1c79abb839020d2613e1d810b4895e5a22e5968c44
- SSDEEP 393216:rvRJhllNUHGcgUVluK7aMIbUwF1VERmj2b:rvj16HvfVlu4nIY092b
- TLSH T1A5F60100FAC700B1E867547056ABF22F5B3861038718DED7FA8C5A85EF23AE25D3575A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/2036-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2036-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\printui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\relog.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\psr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\control.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\setx.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\notepad.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\whoami.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/2036-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2036-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\r\Windows.WARP.JITService.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\drvinst.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\r\chkdsk.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adamuninstall.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_c8691d618eec1ae9\CasPol.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVShNotify.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\AppInstallerBackgroundUpdate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\r\AgentService.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\hh.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\UUS\amd64\WaaSMedicAgent.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_15b623f8f051104d\chkntfs.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\BioEnrollmentHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\AppVDllSurrogate.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\r\dcdiag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2177acc33f68854a\r\IMESEARCH.EXE 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\Defrag.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\windeploy.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\r\ChsIME.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15912.0_none_769e30e9239830f5\AddInProcess.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateBaselineGenerator.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\wcsetupagent.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateBaselineGenerator.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\UUS\amd64\wuaucltcore.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_339d36803282b07117998ed7d2c0f7b6_coinminer_darkgate_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2036