Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 23:18
Behavioral task
behavioral1
Sample
2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 8.3MB
- Sample260415-3almjad18x
- SHA256 1d76b566891b236edf3d8382c2697cd97b22445e2e917976711ef0bbfdaedb66
- MD5 462b26ded4ef7db31d7758172087f292
- SHA1 2a92c45623a8b5daeb39022e31b2c85e7ca54f59
- SHA512 a636c7b44706aacff09802af5a1e2bf09a688d1305f524813d4ee4f53da99af6f9e9f5276dfd6f335cba0b652c06b2c796f5115824ee4ef3a435682a9538a91c
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUIVBXdcGpYqX:OfkchgAOSJdTQdr6c
- TLSH T14996E84AAD2CED22F66E3DF1CC94C6F819183C944952386239F5BE9EDA335C17E09271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\chcp.com- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\write.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral2/memory/3372-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001000000002ad90-5.dat upx behavioral2/memory/3372-902-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3372-3182-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.22000.120_none_60f8436cf8662a7a\LogonUI.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.22000.1_none_1ee8cf461114ced2\MicrosoftEdgeSH.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\curl.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_fca20623da1dc57b\resmon.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.22000.1_none_bba9eafbb68c1dfb\rdrleakdiag.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vdsldr.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\f\sfc.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\cmproxyd.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\hvsimgr.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\r\UsoClient.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.22000.1_none_9d33d1a7f1c90bf8\IMEWDBLD.EXE- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\sfc.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_0f0554e930e1de1c\RMActivate_ssp.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\sdbinst.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\f\SystemSettings.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.22000.1_none_0a473f274297ac75\lpr.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\sdchange.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\f\bdechangepin.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.434_none_26804abdf9690430\edpnotify.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15806.0_none_f04d7e19d4274c7b\AppLaunch.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_8c8f05900e25e4d3\f\net1.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\f\CHXSmartScreen.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\wkspbroker.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\ScreenClippingHost.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.434_none_f949c91148399a9c\CertEnrollCtrl.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.22000.120_none_a5bf55f88f23c8b5\FaceFodUninstaller.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\r\ntoskrnl.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\sdchange.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_674facc3fa15e905\RunLegacyCPLElevated.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\f\VSSVC.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.22000.1_none_24c01bfc869f3c31\whoami.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_fca20623da1dc57b\perfmon.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmplayer.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.22000.1_none_a4046dd80a1bed7d\RelPost.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_d4aecc3168a74ea1\aspnet_regsql.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.22000.1_none_76531c94f831c76b\runonce.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\f\CheckNetIsolation.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.22000.120_none_9268b7169b04c4a6\f\ClipUp.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.493_none_7f8453c6e0afd8f5\r\nvspinfo.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.22000.1_none_0af1ba5c97d13826\nfsadmin.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.469_none_e574fa2e821169ac\SystemSettingsBroker.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.22000.1_none_5026ccd428229c6c\wlanext.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15806.256_none_06f17267440e308f\aspnet_wp.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\f\bfsvc.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.22000.1_none_9b2806fb34e0407f\dispdiag.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_e83cf4fa7871c56f\r\PkgMgr.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.22000.1_none_4cb865a88c5f8f71\efsui.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\r\WerFaultSecure.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sysreset_31bf3856ad364e35_10.0.22000.469_none_3765148c03bcc3ce\f\ResetEngine.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\f\securekernella57.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\r\runas.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmdl32.exe- 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_462b26ded4ef7db31d7758172087f292_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.8MB
- SHA256 de333b6c3e1ac0bd91161872196c3551970554c4862ec6bd006e6f5c1c540daa
- MD5 558e1ad6f36bd926e1e583425c08d114
- SHA1 36539e948d4bda421a8a9af258f05f5bf042d728
- SHA512 87df72f52857a23c7e06667ebd9e6d0f54733ea78be2c01673f45c8b2ecd9b24b98b7796ef35ac785e428bcd28c1a5c329c324f285a028c61b4665feb1149c29
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUIVBXdcGpYqvPji0Ajt:OfkchgAOSJdTQdr6cjop
- TLSH T19E960A4AAD3CEE22F52E3DF1CC94C6E819283C944952346239F5BE9EDA335C17E19271
- MD5 SHA1 SHA512 SSDEEP TLSH