Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/10/2026, 15:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe
- Size 2.7MB
- Sample261026-spd6wsxvbz
- SHA256 ae8788b5a546a90ecae2dd852facd9205862ee921e853f03639e747cdd475445
- MD5 b4842b5b2c40621ac871443879d7d791
- SHA1 6cd2b8f4598002a53049058e4ec5e0344dbca48b
- SHA512 77a6ffb82daad2eeb3fd19075fb40f50d8a4eacfd38a3f8d49d500e91f377e76cd573aacfd3b18641647b52b3ea6ca11d3c43b4509676a4852dedd15f5b2e454
- SSDEEP 49152:J7g4QAeAOAgI1WCsoMPjFTlM26m10gdN7gIrP7CtEC3XuEFSZzhj3v1/E:VrLeAII1dsom70nIqBOzJF3VE
- TLSH T111D5E02673E18036E4B30270D7B9A7AD9579FA31272540CBB3940F0A5D616E2FE3974B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\alg.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\locator.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\vds.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe -
resource yara_rule behavioral1/files/0x0001000000017007-215.dat upx behavioral1/files/0x0001000000017046-219.dat upx behavioral1/files/0x0001000000017bcd-223.dat upx behavioral1/files/0x000100000001742a-227.dat upx behavioral1/files/0x00010000000233fd-239.dat upx behavioral1/files/0x000100000000c51a-243.dat upx behavioral1/files/0x000100000000c53b-247.dat upx behavioral1/files/0x0002000000021eee-251.dat upx behavioral1/files/0x0001000000017ec1-255.dat upx behavioral1/files/0x000100000000fa70-259.dat upx behavioral1/files/0x000100000000c402-263.dat upx behavioral1/files/0x00010000000177e9-267.dat upx behavioral1/files/0x000100000001780f-271.dat upx behavioral1/files/0x000100000000c8e4-275.dat upx behavioral1/files/0x000100000001784d-279.dat upx behavioral1/files/0x0001000000017ebb-283.dat upx behavioral1/files/0x00010000000178c7-287.dat upx behavioral1/files/0x0001000000017032-291.dat upx behavioral1/files/0x0001000000017976-295.dat upx behavioral1/files/0x0001000000017995-299.dat upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe - Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe Token: SeDebugPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe Token: SeDebugPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe Token: SeDebugPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe Token: SeDebugPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe Token: SeDebugPrivilege 4804 2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-25_b4842b5b2c40621ac871443879d7d791_darkgate_elex_remcos_rhadamanthys_stop.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.9MB
- SHA256 c92bf6fe51e9440f27d977a6cacdef5fe0f5eae840bcb3efefe6881ab3ab5726
- MD5 b82487574c0f6dce99c8bff434942425
- SHA1 e592a1148c34e94bb269d0062bd51d1da5921d52
- SHA512 4e71c13d841caba5490ecb22bc51ae3f1acc70982acbf4c75a82272cdb92c9f0b6c2bfbf9bab4b5f452c7e5ea2d57d0702c7dcb4689457ba2d12ee0e8e21a2e2
- SSDEEP 49152:sb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnSuEFSZzhj3v1/E:W3q6gjBwzJF3VE
- TLSH T143E5AE03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1017KB
- SHA256 fad1854dfd4fc4fc99bf62922f0318cd16e5f484e89a2296a369159adfb8bb00
- MD5 883ca10cc7069f851d0c9f475ea95a44
- SHA1 8fbfa753f5136c4abda54f774da735afe1c696c1
- SHA512 4b89862965baa0f6e724ba711a8ae19a7028b600315829cef2686db69aa0e8485dfc9fbadec5147600c6cb30a5449f90cf6fe77a014bccabe0cb580f1ca5c3dd
- SSDEEP 24576:8XYMDtczALHuEQeL7jOZh4udT12UyS3v1/xkR:6tcOuEFSZzhj3v1/E
- TLSH T14125022977E009F8ED678238DDA58501E733B81287A4E39F03F4896A5F277985E3DB41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 997KB
- SHA256 4c9d31b1310eb78bc4056cf6e984c2b51d2c4f92613df13da774ca54d0ff7005
- MD5 07b2b72bfae75ab13c7075080ecd0ff8
- SHA1 bc040908879883e4082313ecfc1db3296ceb3934
- SHA512 1487083676c64fd8db2ffdc26f6e308de07890d061c38b9fdcb45dfb604a5dde45cea6d43402d5f4b0dcb48298332df7504d01e5db713b4c750f000c41529128
- SSDEEP 24576:3wutOWAHuEQeL7jOZh4udT12UyS3v1/xkR:3w2O5uEFSZzhj3v1/E
- TLSH T15D25024676A41CF8E5674538C69BC535F7F2B8022B65C72F13B0CA4B6F27721AE29B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.0MB
- SHA256 b4868aee2ec1995c560fd2a0af38329b5795422b6c93c85a792e2614f2fc607b
- MD5 11da623b5871ff12d754e736c2cda359
- SHA1 e3e8796aa5c00233f75311aee4a2f4202d1301f0
- SHA512 08be0884840c8bd63d2d94b5da64de303193f5bfd16a81e17d8cf20ada0471cd8b37603b5aa40f2871873cc268f84d001a75b868ad402204536b396c0e653ab3
- SSDEEP 49152:oB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glKuEFSZzhj3v1/E:iu6JmTxd2d/zJF3VE
- TLSH T173E5AE13F1D901E8D06ED478974A9232FA62BC490B35B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 778KB
- SHA256 2250ccb54fafaacc37b3e4bebf42b4a0ad305c1345d13e26441634e9872636ba
- MD5 714bb3b48f30575b33bb297a4fd97d1e
- SHA1 d3a215fe034db7441e0ea1177301c2217046f31d
- SHA512 892fc0f6e64646019d61905e2a28a9d9989b90f914a5c0539b7d5da6397f96ff7d00140215c42ae8ec749b5d147a122ee5f95717705f0fcd4534b137cdd0e296
- SSDEEP 12288:LxuHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:LIHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T1A40523166D787738D1B50630FBAC8894A73EB522EFC9C26FA2F80C8AB51DD555E1070E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.9MB
- SHA256 30031d2dae923dfbc56d689cf5e9fe5e6729fe69a4fde0cb63fc7543c46c8585
- MD5 8e75019e18b5bad834ccf6f46eef4ffd
- SHA1 97af3dd954c2c5250eeb8db32bb997af48555ff1
- SHA512 0ba5d25e97a99ca6811ede66ab4a3da31df9cbcbfadbb8005390c97ec4f19ce4e9b966d4d0666d7102243026354541377ffca510ef34bd76c0c1ea19cbbd36af
- SSDEEP 49152:sa0h2GEkuAe73q3ppt6zwwQGuEFSZzhj3v1/E:sa0hNYGtJwUzJF3VE
- TLSH T13A95BF1E67EC82B5D0BAD278C9A6854AE7B2B4221B3156CF1190853D3F37DE44E3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AppVClient.exe
- Size 1.5MB
- SHA256 a825a00581abb830f8fa9218dfc122e4f30177a29fcd0b516c0efe26942ff746
- MD5 3782d1f25fa4443597155dada881d308
- SHA1 62bb3b20b59bc489686cd35034d7d29098c27423
- SHA512 9ef3a958641eca5af2d86be60bc8067fcc610c37dbbc62ec68d2a7a29b8fa7cbc1d0a509cda156250664c4379e4ffb4459f65ff04927324522fd6f2841e442c3
- SSDEEP 24576:e1QT7EcpfxR+N5AWAz3ooiYhjMqbqHuEQeL7jOZh4udT12UyS3v1/xkR:zTDxR+N5YzTTjMhuEFSZzhj3v1/E
- TLSH T12275C02EA7F815E9D1BE85789B238502FB727821073193DF42A0C17E1E6B9D85E76F10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 849KB
- SHA256 9ebda28b42c6586563a3ed0acb315a6cfae8faf031728a43d365e3b9fba8b7c8
- MD5 7ed18df2168114bac1abc6b840516dee
- SHA1 490a3dd615e42e52a2199d650addf0e683ef6dc9
- SHA512 43e9b97a2eaf3f890aa1e738a0b844d1770bf4f59fed0a0f4210da3ecec595dfc106cc4405d52e33109e98b5a41ee3a9ae7a9473e4ff2ab93decbd14575bfef4
- SSDEEP 24576:zhbHjPyHuEQeL7jOZh4udT12UyS3v1/xkR:zhbHj4uEFSZzhj3v1/E
- TLSH T15A05123E2ABC21A8E171923CE6998549D331B8225B5693FF23E5417E5F2BEE41D30F41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.4MB
- SHA256 c18243fbbee57f6e123dd1185c5b46f9f6f71830ff619cac912e8f9725005239
- MD5 a2f12ad299d017b178648e6c577b72c0
- SHA1 5007bb27379d8382c19b0aeb9fb94dff7b04afc8
- SHA512 49f6f3e9638479047b47cc7e324eb2a95f04b7ec49198f56834a7077baee3e5636b341ec1236450db5502bfcd42ccafd97d2a742424cc65b0a1edee7ee7cdfef
- SSDEEP 24576:j+YgnJcRTk4yti+R5dUR/GHuEQeL7jOZh4udT12UyS3v1/xkR:j1gnaTk46pUR/kuEFSZzhj3v1/E
- TLSH T1A065C02EF2B910B8D8A6D236854547B5FB71782D1F2096CB01B4C538AF0AEE85F34F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 768KB
- SHA256 aa83c53a0d7de3174e7d62e9d4d4f8b8507225e742f8c1b317a275a60b15e145
- MD5 1cc2b7d8a718c5ebc6e2d0e59dac2174
- SHA1 99bb04dc792979453944cb60d4dfd44e2e50639f
- SHA512 5095441aa5a2a3bfaff9df34e026bb272e1cea19e0418dc858949294f5cb58e79461750d8c61451982db29a97b7c9bb87b208a9e3aaebcb5627a40bdca4d35f4
- SSDEEP 12288:c8uHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:cnHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T126F423066C747778D5650A30FBEC89C8A379B513EBDA837D62F80C8BB60ED295B10749
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 34c3fc7d75af6aa2316fde91d5289edd6b4a31d4137f13764510968887c815d5
- MD5 595e9e9d823ec19ec7c011178eefecd9
- SHA1 ea4df2bf980d50a31af9997895e8985fcb03a32c
- SHA512 448d68a29f17be0c185911c75d63e26c70378d86d704741aeab8cb0b82e165567168886f416daf347d105742a1cc6c731273c0baf60f04edfef3b5394ccd41a8
- SSDEEP 24576:BHL3UTpHuEQeL7jOZh4udT12UyS3v1/xkR:BHL3UxuEFSZzhj3v1/E
- TLSH T132350115FAA410F8E96B813CC9A68916E372B41D17A4E7EF03B84E562F137E14E3DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 861KB
- SHA256 b480ba69de30670026b89b717cb14b55947a36deb36eafcbc9328f9c77236fae
- MD5 0dfd95ec978c0b3a4602ef3673bb4da1
- SHA1 a35f9995792b73f654129609fee6a81b43b9575b
- SHA512 1c64be29168c8354323027a2cd6590002908225dd9892fcd561659c19d5e30571316d25482a81a2e60ea10b0a7cae7549c39b847c99cd179b8869b076791a02f
- SSDEEP 24576:2OKKfHuEQeL7jOZh4udT12UyS3v1/xkR:2OKKvuEFSZzhj3v1/E
- TLSH T1C015121A3AFC21F8D176513CDA9A864CD371B8225B5253EF02E084AE6F57EF86D34B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.9MB
- SHA256 daccb1029b6d594b60137f7f23019c3990db667d1eee0795e4edc5f70144e680
- MD5 2c3084952ab3427f4b19efcd0986fd6d
- SHA1 f17a9c829f63bec3dac07404c563b1e2ccdd66bc
- SHA512 8742ad339d8e9b35b884f4cd3a6d8c2549037d4b017a9e690c74f4d3d643898eeffe957db22356fcf07bb2c16e227c524a239d57d91b88fd421e8f242171f90f
- SSDEEP 49152:8F2YuHNETovIvNYf8kmjuEFSZzhj3v1/E:Z6ZCf8kZzJF3VE
- TLSH T18E959F2927ED80A4E0BBD27D85F6D146FAB2B8511B3056CF4255862E1F33AF44D3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SgrmBroker.exe
- Size 1.0MB
- SHA256 ae4bb2528b19229ccced1fc39e566cb8a1511f6113062185a9bd6272b14c6611
- MD5 add4f1bce9a09206d37ee78f5ec2289f
- SHA1 980234b08adde13df96c1906a54e431215870816
- SHA512 0b870f9cd43e810a1e8070a4dee9d3b36c3e9258e4b9f9de02742feabc1eb0e48a80e290a5e774fb2662f8609c2094f312638bba40606f3a99aa428ea80a9b03
- SSDEEP 24576:zTMdOz0FFS+HmSLvHuEQeL7jOZh4udT12UyS3v1/xkR:x0K+HmSLfuEFSZzhj3v1/E
- TLSH T16D35F23E676D14F4E57AC17CDA578906E67274220322A6DF06E0C07A3F5BEE47A39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.6MB
- SHA256 3677de0f3bd7c9f71fe15cfd595ae61d1cdb28e432b200c09f96f9521d115c8c
- MD5 613e54549d326ecf495e9c582721f412
- SHA1 208a036780e754d3e602fce889b5d60e1e441dd4
- SHA512 e3aecb66894e98a22f1acbb082d0c236679d84eb7fddffe8fa8b6bb88e5b88119ab753b29d7fd9d8df9c2e88b2b0b9425f4473cf5616bf5d5a639ad11214d662
- SSDEEP 24576:VAFs06+OmlfzNXEbToOHuEQeL7jOZh4udT12UyS3v1/xkR:aFs060lBXutuEFSZzhj3v1/E
- TLSH T14B75BF2F66AC00D5D07ED17D8A96C91AF7B1742307255ACF0260867E7F6BEE81E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 1.1MB
- SHA256 d0a4d6c924b4bb9c2229821318fc448d3965f94bbf63a50a223c2153943e161a
- MD5 7a144ffb240d74a417ea052f87625e44
- SHA1 ace37eae56fd7f0f901298a18eee529667e64cdb
- SHA512 3aa035de3c38e6b1a10cefbd89cc90d47fb23d7d391ef519de786a5d112df7dc565ae6b4e7297203bb4fa0d0f90bdb305a82713355bb05396da579a5bdcb3b5e
- SSDEEP 24576:lJnJ5D3W2OHuEQeL7jOZh4udT12UyS3v1/xkR:lJnJ5DG28uEFSZzhj3v1/E
- TLSH T19F35E12DD2A810F8D4B7C27482991B85FF72342D2F266ACB24B4D5357F16EE09A79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 911KB
- SHA256 0b80e791631f6d3f9f3aefe9d19565ceec6010fe7e0007a9fe88529d49005cbd
- MD5 01efe0232f92251e22b17f7731757aca
- SHA1 861967c533f241236aa848553e8e729e27ab4eaa
- SHA512 06a9e7f29e275a321b3bf1228de7f93763ca154ff5393a996cf7d3bab8a703b17651e45b0779a2d489866a5aa035f634e4528e8f310b72f7d2ae7ecd534f1ef6
- SSDEEP 12288:Jq7oPAUhm63k47IIXdwcXrif6yO/ABkEIDpOw9o+:wEPFhm6/7IIXdwcXrif7qQn+
- TLSH T17015F718E75A91E5CDB2C4F1C646E52AEA317C10933C7AEF4FC1CE765E22AE1A53D600
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 850KB
- SHA256 34f39d0aa5e5ec7abd352b06eeb69a924305d4f7bbb9701ef1b77fc5d211f766
- MD5 279a11b9a75b7cdd0b5a1340e5a6281e
- SHA1 e062d9a6823056a71129266d5bfe048410ad8b49
- SHA512 1bd8bf2802134e31edbccfd482c75631e33c3adad29f9fb95960acfb1d0ee8af6391bbc3a468b26e449cc8c8e11c0b034c1f786ff872f8362e954217f0099e7c
- SSDEEP 12288:eEP3RifVuHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:9ifcHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T1C305121E2ABC71F8D1265138E6A48584D372F0316B9653FF12F4857E9E2BDE91E38B01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 902KB
- SHA256 2eeadf88f87acb6f3c70b8b0aee2f86e98e44b8922863f44978547dee0126f4b
- MD5 849a393fbc2aa5e9f1bbbd119f7cbb05
- SHA1 e51997beb5ee1c0997ef1148b4d655c72d736ff8
- SHA512 9f0bd09a3fb40a457c11929270fd5bb1804a03f373e561f330dd9f0205abf8ae16cd74bfb2c241905e9b10f3cb874f23c4cacbcf7d5b2aa75fb0b2275ba1f8d2
- SSDEEP 12288:IjkycuHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:IIyHHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T13B15230526B461A8D5B50634EBBA81C49B35FC21AF5583EF51E0992F7F3AFD06E30B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msiexec.exe
- Size 825KB
- SHA256 12813aadf751e569ddb8e0d92c4341f9bd8ca03558aaf02b42adef4bc930e7cf
- MD5 e259373b17a472fb6786351040976d6c
- SHA1 d1f519bc89c64284f019b0a10456fddaea9e2bac
- SHA512 d5150640e9270b2eca2b6ea918a2bff64821e878b29109896495e070bb2f38cb7b8864e340d742ce09f23ad57251171b31a70a52d4d447be3b52e823bd2ac9d6
- SSDEEP 12288:IZz0zuHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:Q0aHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T14005221D26F831A4E4725634EB7D45849334B822679553FF22F4CCBEAF2ADD49A30B06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 773KB
- SHA256 3083355c9d382b28802b4a35e9861ba4f413fb80b437cab645aa0327a7d89eab
- MD5 b23bf1f20231377c14d5a950647ae7a5
- SHA1 8cf9fa792b264f6122b26db10ca00554dfb57058
- SHA512 769a69c28d535e9e98951cb7ea3f500b944f0729c47045edcf5f6d6865834fe995a0bfc7228dc5bf986268a3a85dd44d7315226706b327497a4ad1180d941dec
- SSDEEP 12288:PBuuHuEIpUHWeL7vebeOZh43gVdT14aspUEQPW+sCLTo61POnDSJ1BRksk1:pZHuEQeL7jOZh4udT12UyS3v1/xkR
- TLSH T113F4231A2C747378D6660630FBAC4DC4A379B423EBCA92BF62F84C9AF60DD155710B49
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.4MB
- SHA256 6de7b856e3f2be0a0a57247f623b2a88c456fbb512ca9eb2eb851f29b6f5f819
- MD5 81d3f39c742f3d16f25439bdf4f6439f
- SHA1 244572db3c25b4fe2b0cf91a235a463b5c1168c7
- SHA512 eb571554b5d0c20d79d4015d035b742d1e814cf35dad2e3b89b189fceb31729d6c2ee2742ce7987106a2965056b2cc735b1d09103a1dccb6109cb47e6eea82e8
- SSDEEP 24576:8Q9MxZKdcz9ew32HuEQeL7jOZh4udT12UyS3v1/xkR:8VKi0uEFSZzhj3v1/E
- TLSH T1F2659D2DABE9059AE177D235D5A640C3A633B4311B35C6CF2448D03D4E7AEE8AE74F21
- MD5 SHA1 SHA512 SSDEEP TLSH