Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/10/2026, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 3.6MB
- Sample261009-pr63xaba59
- SHA256 4139bdcfb9c795385f4005d562f4bb3c3a6bad37356d116e420cbde4823d76f8
- MD5 6af0b376366fc6af1cd8969d6190257d
- SHA1 470cd01aa4e45e04023bc4a8cf0f08e2b5be9e86
- SHA512 a5621a252a4ef7e43d7a02ee8660b02f9b20103b1a7656c72eb6a6a5e1bbff2c09c8f01ab89bf7ba2b9b1aec05128e328c33300b63524a1f9c95cfd11a9e39d9
- SSDEEP 49152:b4GEIrjph7GBfWjgJt4kjsiph7GBfWzph7GBfWIdMcHJNi78YHZnyYpYqB:f77GBfWjNG77GBfWz77GBfWYMK+8k96i
- TLSH T15106290163E54032F5B3367088B663744A367E755F36C68F9688B95EAE73B818832377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dtdump.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\systray.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\printui.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\fc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\at.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\logman.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\runonce.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\compact.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\printui.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\raserver.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\r\UNPUXHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\r\wermgr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\diskperf.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\WorkFolders.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\doskey.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\typeperf.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.19041.1_none_a03b7086d9468b36\DeviceProperties.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.746_none_a9ff72b1a43fd663\r\DeviceCredentialDeployment.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\wscript.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\f\autochk.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\f\uwfux.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.19041.1_none_3dc4aae45a75023d\InetMgr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\aspnetca.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\r\msinfo32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_a2eda420e70d2fc8\dsacls.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.1266_none_d375b5361b806b32\WpcTok.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmEngine.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.662_none_746c3bfaa509091f\f\dtdump.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_861f5c69fbf3d066\AppLaunch.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\backgroundTaskHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1_none_0d7764d82a75e629\BitLockerWizardElev.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MpCmdRun.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_f53047daaa565a5e\dllhost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\r\GameBarPresenceWriter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\iisreset.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\r\bash.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\r\IESettingSync.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasdial.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.19041.1_none_1939c8a90c4232f6\xwizard.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_b1e0044e8cab889e\setupugc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\FileExplorer.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.19041.928_none_6571ff6e96271a64\r\hcsdiag.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\lpksetup.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\unregmp2.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\r\FaceFodUninstaller.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1_none_14f1e9e91239944a\MdmDiagnosticsTool.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\TextInputHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\SpaceAgent.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\hvax64.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\SpatialAudioLicenseSrv.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.19041.1_none_0c7fa8d5ebaceac7\ipconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.19041.1_none_dae2223cd3e6f926\AddInProcess32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\f\SnippingTool.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_b6126993bc8370e6\SMConfigInstaller.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\agentactivationruntimestarter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\r\wslconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\svchost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchProtocolHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 4.2MB
- SHA256 dbe1adb1a5f752f6c2da84bfb8cdadb7e1790b0b42ca208d27ae05f42f7b01aa
- MD5 09b7f12fdc4b062fb6358090ef520432
- SHA1 d66d24cf23083ddfec29b6acd995de035f4dc016
- SHA512 31633337dc4b1e1c5d25c5121112ff7db57f256e20399e3cbc144ba607c39ef558422b2a511590b6e861bb7a487ea06d80e9c87e93e257230ef37b5b3d2a1594
- SSDEEP 98304:f77GBfWjNG77GBfWz77GBfWYMK+8k96OjoA:nGBfWj6GBfW7GBfWtX96IoA
- TLSH T1A1163901A3E54132E1B3767088B6A3758A327D715F35C68F5688B96DAE73BC18832377
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\SkipSend.bat-
- Size 4.1MB
- SHA256 35237d6cade689b41d267815e7c252e012ca24e6e327b488843a9e2d27fa3053
- MD5 761ec9338f292c97fd18bb4a57097dc9
- SHA1 d934163729203400ec6f73fb76b3d39ab92602fa
- SHA512 72a537fed43ba5b6b8d1c6b8ec656855a0048f4e5dc1b67f7957f14725cc3cd3e8606d8d2e906976f4b4b3eeae1f5763109a0456299c3e98789042c0dc9ff543
- SSDEEP 98304:f77GBfWjNG77GBfWz77GBfWYMK+8k96sfn1DV:nGBfWj6GBfW7GBfWtX96sfn1DV
- TLSH T19A164B0163E54022F5B3367088B673744A367E755F36C68F9688B95EAE73B818832377
- MD5 SHA1 SHA512 SSDEEP TLSH