Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 17:41
Behavioral task
behavioral1
Sample
2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe
- Size 9.2MB
- Sample260913-v9f74a1aph
- SHA256 23c66dc4eac54468c85e334ac03781db21a3b6b420440f4e0fff1453f7edcf25
- MD5 13afb241d3d9a9aaf84db1043d62b7eb
- SHA1 9488281e718b3f5a470d68939f9049115c7290ac
- SHA512 f8094bd62cad076168e49b2aea03490dd6d545479958c2cdbe608366b467865ea23334911a1abbc76d17e3258f845f37d560ce2e6244870c969323050b43f210
- SSDEEP 196608:rv8zMhT227p+VDtj4Z/X8SxFC/KnfzNg1mPvKQ2jptOjt6W4vkllNU0SLGcgUZXu:rvHJhllNUHGcgUVluK7aH
- TLSH T182A6E040FACB01F1E957543052A7F32F5B349103C518DF9AFE9C9681FF23A624A2979A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/2752-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2752-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certreq.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\comp.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\subst.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\control.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\regedit.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\wscript.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe -
resource yara_rule behavioral2/memory/2752-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2752-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\ShellExperienceHost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\r\tar.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\GenValObj.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\sdclt.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\powershell_ise.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\iotstartup.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\r\bootsect.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1150_none_858f29bf9f3816d2\mtstocom.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\dpnsvr.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\r\RunLegacyCPLElevated.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\r\TokenBrokerCookies.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_dual_kdnic.inf_31bf3856ad364e35_10.0.26100.1150_none_0d22cb5713b04a04\r\kdnicctrl.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\r\dllhst3g.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\r\IMCCPHR.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\la57setup.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\SensorRuntimeBroker.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1150_none_fba3bb9888bf82a5\CompPkgSrv.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\dxgiadaptercache.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\runonce.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\TCPSVCS.EXE 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\winhlp32.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\r\verifier.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\ApplyTrustOffline.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_931673d5fd963a61\driverquery.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\ielowutil.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_13afb241d3d9a9aaf84db1043d62b7eb_coinminer_darkgate_elex_glassworm_icedid_memery_njrat_re.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2752