Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 22:30
Behavioral task
behavioral1
Sample
2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
- Size 16.4MB
- Sample260916-2e3k6sfa82
- SHA256 1e462621361e88d53f9935b6e35a410d3730269e3977c321183473cb3f5cc126
- MD5 3a3aebe6bb679b86c2dbae7e861686fc
- SHA1 a80dd7f4992849ea95b37628d59e7fcb569f9040
- SHA512 0372114fa1ab2acaec20eca870f15f49762f2efb8e3059c33d838b57705df4a15dc0e8f8b67aab88ffc1a220df773b7d579763295fc0cade4622768c05565262
- SSDEEP 196608:/aH64eGZF6bUpMBF1p/kjRm4OWi2b/eGZF6bUpMBF1p/kjRm4OWi2b:/6IbUwF1VERmj2bXIbUwF1VERmj2b
- TLSH T11107020177D14128FDF706B689FE616C557DB9A10B28D0CB62C826EE5B22BE0BD32753
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UPX dump on OEP (original entry point) 16 IoCs
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-1-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-2-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-3-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-4-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-5-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-6-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-7-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-8-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-9-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-10-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-11-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-12-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-13-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-14-0x0000000000400000-0x000000000040F000-memory.dmp UPX behavioral2/memory/3492-15-0x0000000000400000-0x000000000040F000-memory.dmp UPX - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msinfo32.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cacls.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logagent.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Dism.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\logman.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\runonce.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\msdt.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\user.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\ftp.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\attrib.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cttune.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\hh.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\cscript.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\dialer.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe -
resource yara_rule behavioral2/memory/3492-0-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-1-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-2-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-3-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-4-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-5-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-6-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-7-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-8-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-9-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-10-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-11-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-12-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-13-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-14-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/3492-15-0x0000000000400000-0x000000000040F000-memory.dmp upx - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\r\AssignedAccessLockApp.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\dllhst3g.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\r\ldifde.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVShNotify.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisreset.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.26100.1150_none_f64f3a9ea7a6b9a1\WMSvc.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\MDMAppInstaller.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\perfmon.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\r\AppResolverUX.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVStreamingUX.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\r\fixmapi.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.26100.1_none_6286baeedbc54537\LogonUI.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\r\DiskSnapshot.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\bootsect.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\r\Eap3Host.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\r\HelpPane.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\r\WerFault.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\r\mmgaserver.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\cmd.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\r\MdmDiagnosticsTool.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\r\ChsIME.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-16_3a3aebe6bb679b86c2dbae7e861686fc_amadey_coinminer_elex_glassworm_luca-stealer_memery_njrat_remcos_smoke-loader.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3492