Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 16:48
Behavioral task
behavioral1
Sample
2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
- Size 3.8MB
- Sample260913-vbeavaswex
- SHA256 906060646b4ebc4b51624b3e909254bb4ae3e6d201339cadbe21760b2a97465e
- MD5 29d637a9f14b29bdf11d08ef4368655a
- SHA1 46d73f54e2a8d5bfc3a34d98dbe09486a3a23e59
- SHA512 a86dd03603c39ccd42217d9fb923c7230dadae9d5208055880453b4c0d8921736bf8ca3b3b931a7cec4a4721c50c82da4c9205a0a92be857df8be650017a3bac
- SSDEEP 49152:f8TMQfhTnDPkB5FREPtAxrCcGU8+kB4gb3OP1m8vPHve/idPYuAbRlmZF8Ga:kNIpxrXGxqvO/cPYP
- TLSH T1C606E6026BEC0468F5F32B388A7A99509A37BC560B34D5DF02981D5D0F73AC29D76B72
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral2/memory/2772-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/2772-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\choice.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\convert.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\timeout.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net1.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/2772-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/2772-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.26100.1_none_55e7b933a1108505\xwizard.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCLNWZ.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\r\mmc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\r\ShellExperienceHost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPDCT.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\r\mstsc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\notification_helper.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\r\OpenWith.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXLauncher.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\r\MDMAgent.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\r\Windows.Media.BackgroundPlayback.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.26100.1_none_3182dffdaeb31123\SrTasks.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\rdrleakdiag.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_a98d653d335a00f2\aspnet_state.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\r\omadmprc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCLNWZ.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\r\at.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\r\Utilman.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1_none_f74329f6bb45918a\cttunesvr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\r\fixmapi.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\r\PkgMgr.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\tracerpt.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\sessionmsg.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\winrshost.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1_none_dd2e628f17bcb344\TSTheme.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCLNWZ.EXE 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\PerceptionSimulationService.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_b667649ed5836b0d\aspnet_regiis.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-locator_31bf3856ad364e35_10.0.26100.1_none_cc283b8d55248fc5\Locator.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.26100.1_none_eb5719295fed7363\WMPDMC.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-13_29d637a9f14b29bdf11d08ef4368655a_amadey_coinminer_darkgate_elex_icedid_luca-stealer_memery_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2772