Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 16:48
Behavioral task
behavioral1
Sample
2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
- Size 3.8MB
- Sample260913-vbeavaswex
- SHA256 906060646b4ebc4b51624b3e909254bb4ae3e6d201339cadbe21760b2a97465e
- MD5 29d637a9f14b29bdf11d08ef4368655a
- SHA1 46d73f54e2a8d5bfc3a34d98dbe09486a3a23e59
- SHA512 a86dd03603c39ccd42217d9fb923c7230dadae9d5208055880453b4c0d8921736bf8ca3b3b931a7cec4a4721c50c82da4c9205a0a92be857df8be650017a3bac
- SSDEEP 49152:f8TMQfhTnDPkB5FREPtAxrCcGU8+kB4gb3OP1m8vPHve/idPYuAbRlmZF8Ga:kNIpxrXGxqvO/cPYP
- TLSH T1C606E6026BEC0468F5F32B388A7A99509A37BC560B34D5DF02981D5D0F73AC29D76B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 14 IoCs
resource yara_rule behavioral1/memory/4556-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/files/0x00010000000081ea-13.dat UPX behavioral1/memory/4556-25-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-30-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-31-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral1/memory/4556-32-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\control.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\secinit.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\svchost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/4556-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/files/0x00010000000081ea-13.dat upx behavioral1/memory/4556-25-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-30-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-31-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral1/memory/4556-32-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_f53047daaa565a5e\dllhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\f\conhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\r\fhmanagew.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\setup_wm.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\f\nfsclnt.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\r\fltMC.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.117_none_975feef459c69d6b\CheckNetIsolation.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\AuthHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\f\wuauclt.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\f\WinSAT.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_0ee51e56d7e170fb\xwizard.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\CompPkgSrv.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\ShellLauncherConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.19041.1_none_1c5807cd8d0c767e\OptionalFeatures.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\r\ApproveChildRequest.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_47ec758ff9f94aa6\TapiUnattend.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\r\vmms.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.1_none_9b8799837b1e944c\WindowsSandboxClient.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.19041.1_none_da2034c2127c2568\dmcfghost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsimgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\f\DeviceCredentialDeployment.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\r\ShellExperienceHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmimageworker.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFaultSecure.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\sppsvc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_477a57e55b61aba8\r\SyncHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\r\rdpclip.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_bb8aa452b18b9835\PresentationFontCache.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\f\TokenBrokerCookies.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAppMonitor.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\f\dmcertinst.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\r\WorkFolders.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.1_none_e1940364964a9f22\AuthHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\r\setup_wm.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\r\rrinstaller.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_b22e8a4512f5879a\WFServicesReg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\f\ClipUp.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\f\recdisc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\NETSTAT.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\ssh.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseCncProxy.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_bb535abd48713dff\wecutil.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\f\fixmapi.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.1_none_7c69077ba55f962b\WSReset.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\SysResetErr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_f4a6d735c6ae17c3\GamePanel.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\wabmig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\ShellLauncherConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\rpcinfo.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\sihost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_e409500831824146\dxdiag.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\ie4ushowIE.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\r\PktMon.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.19041.1_none_d3e3ad84b24cfdfe\NisSrv.exe
- Size 6.6MB
- SHA256 72d580ed8ad800ceb95e8a6a3fd8582c8ab47cc09b1debbd734bf7468d249744
- MD5 741f06dc6e009bac3f0ab9ecbe83f986
- SHA1 09dc441e380696379dda3f11a28512a00017eb75
- SHA512 a7da1a406f5b9458277c943fe71dd4db599a4dbbd56eabdf675687beded08b21379330432019903685b94bdf48fa7cf71e43a232fda537b019bd04f9c36c7f0a
- SSDEEP 98304:kNIpxrXGxqvO/cPYG5CbhLajkWHEsr37:kGpFvqcAGKhLajki
- TLSH T1AA665A0267FC4054E1F396788A7A9911E6337C1A4B34E5DF0298592E0F33BD19E7AB72
- MD5 SHA1 SHA512 SSDEEP TLSH