Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
- Size 3.6MB
- Sample261009-pr63xaba59
- SHA256 4139bdcfb9c795385f4005d562f4bb3c3a6bad37356d116e420cbde4823d76f8
- MD5 6af0b376366fc6af1cd8969d6190257d
- SHA1 470cd01aa4e45e04023bc4a8cf0f08e2b5be9e86
- SHA512 a5621a252a4ef7e43d7a02ee8660b02f9b20103b1a7656c72eb6a6a5e1bbff2c09c8f01ab89bf7ba2b9b1aec05128e328c33300b63524a1f9c95cfd11a9e39d9
- SSDEEP 49152:b4GEIrjph7GBfWjgJt4kjsiph7GBfWzph7GBfWIdMcHJNi78YHZnyYpYqB:f77GBfWjNG77GBfWz77GBfWYMK+8k96i
- TLSH T15106290163E54032F5B3367088B663744A367E755F36C68F9688B95EAE73B818832377
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\control.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\help.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\net.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\print.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\finger.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cipher.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\convert.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\chcp.com 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\notepad.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\user.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\UsePublish.bat- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\phoneactivate.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1000_none_e9c96c85d0fddddd\mstsc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\msiexec.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.26100.1591_none_b67e058f470e99bc\r\SystemSettings.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\MiniSearchHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_538243b2b4dbfed1\ipconfig.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\r\AssignedAccessLockApp.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\omadmprc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1_none_2236fe932b70aa37\dccw.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\DWWIN.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_69287f183fd23745\aspnet_wp.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\WorkFolders.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\lodctr.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\RemoteAppLifetimeManager.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.26100.1_none_25d9db2c4f37e5a9\MdRes.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\r\SystemSettingsAdminFlows.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\r\GameBarPresenceWriter.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\hh.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\notepad.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\setup_wm.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_5fe953095cd8da00\xcopy.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_901f30f8c2af7d1e\aspnet_regbrowsers.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\r\NDKPerfCmd.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1_none_b3959cfa7e715aba\PasswordOnWakeSettingFlyout.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1_none_10c9402dd04d0788\PresentationHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\sethc.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\ScriptRunner.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\Microsoft.Uev.CscUnpinTool.exe- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\r\PING.EXE- 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-08_6af0b376366fc6af1cd8969d6190257d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.6MB
- SHA256 7a7b04940c88c9c04ca3f0ce7b922e449d4b960fff36af6adb294cd23b97c644
- MD5 2768836c3b07f6341fe0be4818c574c8
- SHA1 230af21a360b01cf3f79d18978d2f7fc6638074f
- SHA512 2a6be9bd78ecfdb117d71e8ba3d8b6e2f1971fb9752fe23c4063b5554a029e86129fa1c3e371e587d826f6c59a54772f414bd26a675801c4ee189717b35808fb
- SSDEEP 98304:f77GBfWjNG77GBfWz77GBfWYMK+8k96TezSC6v2XMHh:nGBfWj6GBfW7GBfWtX96AO
- TLSH T14C263901A3F48122E1B3B67088F677759A323D615F35C68F5689B62D6E73BC18932336
- MD5 SHA1 SHA512 SSDEEP TLSH