Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/04/2026, 04:26
Behavioral task
behavioral1
Sample
2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.2MB
- Sample260421-e2re4ahw3m
- SHA256 3803aca429f0955f6ec15e342c248b8d2290b25d045b366b610be24756bdcb33
- MD5 2520e3bf144caff3e5bce0cd4f6bbf9b
- SHA1 64dc83b7d544f115a197e120cb6a43d4c28e8d3e
- SHA512 1cc9042cdbbfeb7d7eb4b23a5948f71485b2f30b98e1310ef43487e917ff0f32dedfa1329a97c74a932200c97918837541a3003fd51c35b5195575a8125cba99
- SSDEEP 24576:1I1lwH8OhQfK56rsJ5/6vNtdTaZ+s57xjRaSDMiA2PqCW+9M:fcOCfY6rsP/IaZx57xjRaUMiA2Pq+W
- TLSH T14BB59D2EFE909DB9E5620031CAB4E75D1229BD310B2191C7B298761DEE31FC26E35B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\makecab.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\secinit.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\systray.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\control.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral1/memory/4584-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000e00000001efa4-5.dat upx behavioral1/memory/4584-1332-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4584-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\r\DataStoreCacheDumpTool.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\r\wscadminui.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\r\bash.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.19041.1_none_9ed23f0cea1bf54e\DeviceEject.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\ShapeCollector.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\r\TrustedInstaller.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\f\wiaacmgr.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\r\IEChooser.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3038e0b9fa4d9cdf\DpiScaling.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.207_none_ac38fc33d542b487\f\WorkFolders.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.423_none_d8a242bf396f7d4d\f\SpaceAgent.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_ee5c058bea34543e\f\WmiPrvSE.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\rundll32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.19041.1_none_60f873a5caaf6704\WinMgmt.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\CustomInstallExec.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.1_none_484e61e96e69ac70\CameraBarcodeScannerPreview.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\InputSwitchToastHandler.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\sftp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\tracerpt.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\PATHPING.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\Defrag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\r\powershell.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\unsecapp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\r\ByteCodeGenerator.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\AxInstUI.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\f\RuntimeBroker.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmdiag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\eshell.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\logman.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\f\wslhost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\TRACERT.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_f0e6f722ec2403d4\rrinstaller.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\r\rrinstaller.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browser_broker.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\f\MusNotification.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\f\dstokenclean.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\f\fltMC.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\diskperf.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\rwinsta.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\r\PhotoScreensaver.scr- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXLauncher.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1237_none_9ad73d125ac89655\bfsvc.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8089599dd595a93d\InputSwitchToastHandler.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1_none_35d43a0ec2872060\SettingSyncHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\WmsSvc.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\r\BackgroundTransferHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.19041.1151_none_c86feb6936a97173\r\omadmclient.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\diskperf.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\f\wsmprovhost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1288_none_f26bd0dcdf662cc9\AgentService.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\r\LicenseManagerShellext.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\SnippingTool.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\sdbinst.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\explorer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4584
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.7MB
- SHA256 0fccd4f1837199544f6889ce0f847ae211e18c3ed6947ccd7b16f16b493ca703
- MD5 fe581a593478b542269f221fe25bb372
- SHA1 dda6ef275f9eb40f4eebeaf7189907397510c83d
- SHA512 65e5147f6697afdb957d2b1ed8061e6a4ae83650ae5c5653164a71ee46fb078fa9ce8095cfeb993293718984caf4aeb814bd4a8e688ee34f22440ad0f7d41787
- SSDEEP 49152:fcOCfY6rsP/IaZx57xjRaUMiA2Pq+8Pji0Ajx:f2g1PTJxjRXzEjo1
- TLSH T125D57C2EFE608EB9D0724071C9B5E75DA6357D210B3185C76288B62CEE32FD25E35722
- MD5 SHA1 SHA512 SSDEEP TLSH