Analysis
- max time kernel
125s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/04/2026, 12:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
- Size 1.5MB
- Sample260417-pyebgag13x
- SHA256 814252e3541fb291f7f6224d7aa278895f42f3ffaa4cda359dbc8212a931dce7
- MD5 1c563af0657ed51d7f9ebea116662165
- SHA1 bc874811d2a165b2d1b8253fa2e2a4f1c9576a13
- SHA512 d182bbf8ea969a0858ffa61b2af13e883469268e93a4e6c27342dde59599e36b666dd8cbaed95e79f33064574e4827e64840d2c51304edda335f3428d3645569
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUl:akaDdljaV7uNRXNxkaeJq
- TLSH T19975AF52EAB4E1D1C7BB08309E66C7216A34BDA10B115AEBE278F76D9D313D03F35A11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 6 IoCs
resource yara_rule behavioral1/files/0x0007000000024380-6.dat UPX behavioral1/files/0x00030000000229cc-14.dat UPX behavioral1/files/0x0003000000021610-1260.dat UPX behavioral1/files/0x0007000000020243-1357.dat UPX behavioral1/files/0x000700000000073d-1623.dat UPX behavioral1/files/0x001a0000000006d1-2089.dat UPX - Executes dropped EXE 1 IoCs
pid Process 1400 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4480 2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe 1400 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_1c563af0657ed51d7f9ebea116662165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 814252e3541fb291f7f6224d7aa278895f42f3ffaa4cda359dbc8212a931dce7
- MD5 1c563af0657ed51d7f9ebea116662165
- SHA1 bc874811d2a165b2d1b8253fa2e2a4f1c9576a13
- SHA512 d182bbf8ea969a0858ffa61b2af13e883469268e93a4e6c27342dde59599e36b666dd8cbaed95e79f33064574e4827e64840d2c51304edda335f3428d3645569
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUl:akaDdljaV7uNRXNxkaeJq
- TLSH T19975AF52EAB4E1D1C7BB08309E66C7216A34BDA10B115AEBE278F76D9D313D03F35A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.8MB
- SHA256 9a7df102fb67724cafa90850c9921e76119463f1e5bb49f880e1b3f303531d2a
- MD5 29f042af6e4b578325a9b96b34f3757f
- SHA1 0e1cbc6a0b3997535a36dca458143fb5d8cfebb3
- SHA512 62eaee6156287c05fd51d2992038cfd353da702c5f1c1da2e2cd517127509df0e7db555a40f982d3758df1996e111fac3847a55d168ea07ab6c9675246bd0109
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUlY3UNUpEisI:akaDdljaV7uNRXNxkaeJqGUN+Eir
- TLSH T1DD859E62EEA8D8D1C67B08348D56C711B735BDA10F115BDBA274B32E9D333D06E36A21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.0MB
- SHA256 e396e2b3075836f29bb8877f97dd75c9971c6bbc61229ece5581f82b44d2cd6f
- MD5 3ba44bad6f7878aa851be80dbf42c858
- SHA1 e33d4be637b84a93d6e54bdadf669e7e888d53ae
- SHA512 b27a71c340ae35a948791b8540df421bb6d8605c5b13c0da9ea50c6ae243daed676b2e188c54d97fc7947fe24b6834ce9750e3508654989db17c37ec402d8b86
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUlSUr2d29dBrtpDiI:akaDdljaV7uNRXNxkaeJq6UidGl
- TLSH T1D8A5BF52EAA4D1E1C6BB08308E56C711AA35BDA10F105AEF93A4F37D5E327D06F36B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 145b157a92eb1eaa46586171da7c2d170b9956bd49372460b6824386d833b8d8
- MD5 e6606e32b725562d4ed3f1f65fb553a0
- SHA1 8199038a450a4df2f7a2856a39cb83a06a4139f3
- SHA512 f0cd2b3f3c2308eb53ebb4f72184c90ae8b4589ad0403234b8bce07ba3fceff94e1db5dd6a2c9e1f3f2ce6ca38af6605a95549c17651f4557074d7b790c7df92
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUlm0Le5ji0hmxNrM:akaDdljaV7uNRXNxkaeJquPji0Aj
- TLSH T126A59E12FAB4C2A1C1B78470CEA2D755EA317D910B204ADB92A4F77C5E337D16E36B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.6MB
- SHA256 e80e74fe94315eb9393fc751d928b4cbccb4aea6bfa27dca9fed1311d3c77dda
- MD5 9a0978200499f3cb1d1c9c73fa60f666
- SHA1 0a02b5b21b9e22931cdc6308ec9eae9c26b370e7
- SHA512 350c7e124deb3680988e6baa93b9b769743e18a3adae0039666636839957c9eac1637277910fea276c51ae47a7fc00ff54c67cdfdf3339ee1f3f30b8a6136b0c
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUlUF:akaDdljaV7uNRXNxkaeJqW
- TLSH T190759E52E9E4D191CBFB0830DE66C7116A38BEA10B115AFBA268F76DDC313D07E35A11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.5MB
- SHA256 2abc71a2e838c3b15dfa3815258cf7c806d1c1858f1e35b4505f7fd0e93c31d6
- MD5 a7358d37b3e4699161c088d1122be254
- SHA1 539295af21cfe9faa05c547483dccb4a018a8676
- SHA512 6b006aadf9b0136d0bd8c0b7aaef2febb704b184acdb9ffbe42f29b558cd50fd93fd79b61e1bf2bf9fa19cb9dcb0e4915fe990198aed2760711f21453512b18d
- SSDEEP 24576:a6Mntq6Mnt6xDxgaewsAjaV7uNRjr4CFTlT6QDeJqkUlFBl:akaDdljaV7uNRXNxkaeJq
- TLSH T15975AF52EAB4D1D1C7BB08309E66C7216A38BDA10B115AEBE278F76D9D313D03F35A11
- MD5 SHA1 SHA512 SSDEEP TLSH