Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 13:08
Behavioral task
behavioral1
Sample
2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 7.8MB
- Sample260415-qdf51aez2m
- SHA256 ccfb1543ce73e30cff97a61bab1787b2d6cec0cf9041c488378fa6a612683fd3
- MD5 15f16382d2b594e6e6a0d12e367fc80b
- SHA1 ae8e7853ae862a79377f8f7592023e2ac7c8e881
- SHA512 099934b2e0656ff7d04202f36e463c64b34cf79706bcdc69d8b0248a15dc18e78605650a467bd35e61c9f6a0c0012f830bcb0ffde55291d2fcb887d184553e42
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUbpYqU:OfkchgAOSJdTb6f
- TLSH T1DC86C64AAD2CED22F62E3DF1DC94C6F819183C944992386239F5BE9ED6335C17E09271
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\attrib.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msra.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fc.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\user.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmc.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00130000000242a9-5.dat upx behavioral1/memory/2360-678-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2360-3196-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.19041.867_none_099246ae3a45708c\printfilterpipelinesvc.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.19041.1_none_03b1ddb5a4b06088\RelPost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_59f3ce100425ffb0\SMConfigInstaller.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\f\MuiUnattend.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\UserAccountBroker.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.19041.1_none_c9c6a551071df37e\PresentationHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchProtocolHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\f\AuthHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFaultSecure.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\f\rundll32.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\r\backgroundTaskHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_0f8992295edbadb4\eudcedit.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\f\SystemSettingsBroker.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\f\mstsc.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\f\MusNotification.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15805.0_none_6d5f51303f9aca21\SMSvcHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1_none_9613f8b833f2e8f1\ByteCodeGenerator.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_2fe41983d5cad0a7\DevicePairingWizard.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_d1d4cd9c4b409594\TabTip32.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\r\wusa.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\conhost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizardElev.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\securekernel.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8ade03f009f66b38\InputSwitchToastHandler.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\r\dxgiadaptercache.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\wmplayer.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmUi.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\sdchange.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.19041.1_none_d25dd411ed85e6ba\ksetup.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_75cabfc3071adb42\certutil.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\hh.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\tracerpt.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\relog.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\r\dsdbutil.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winresume.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\dmcertinst.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevAgentPolicyGenerator.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\r\audit.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\f\smartscreen.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.19041.1202_none_d965e0f65a4ddcdf\f\BdeUISrv.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1_none_35d43a0ec2872060\SettingSyncHost.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\r\icsunattend.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-baaupdate_31bf3856ad364e35_10.0.19041.1_none_ec3fd410728598b3\baaupdate.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.746_none_96167fa49059f7a3\shrpubw.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.19041.1_none_3c6036d4b220f210\InstallUtil.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_c6dc1994db088235\CasPol.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\vmms.exe- 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_15f16382d2b594e6e6a0d12e367fc80b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.4MB
- SHA256 c4ad096319299286d9a40b297151193a7930ff54ba54e17bdecce980858cc325
- MD5 aa206014375c2871f9436815fce6d13e
- SHA1 221fd1b4e7a3bda0ca01430776e17b5d763979a0
- SHA512 2696f465d6d57a8894dedae6a908860abfdf0f4498c973aa61249b5886e6e7f805bb1a155ee7ee128eea338b003956c8b380729f180adc1ea14025998053ee2d
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUbpYqOPji0Ajy:OfkchgAOSJdTb6vjou
- TLSH T1C896E94AAD3CEE22F56E3DF1CC94C6E819183C944952386239F5BE9EDA335C17E09271
- MD5 SHA1 SHA512 SSDEEP TLSH