Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 04:26
Behavioral task
behavioral1
Sample
2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.2MB
- Sample260421-e2re4ahw3m
- SHA256 3803aca429f0955f6ec15e342c248b8d2290b25d045b366b610be24756bdcb33
- MD5 2520e3bf144caff3e5bce0cd4f6bbf9b
- SHA1 64dc83b7d544f115a197e120cb6a43d4c28e8d3e
- SHA512 1cc9042cdbbfeb7d7eb4b23a5948f71485b2f30b98e1310ef43487e917ff0f32dedfa1329a97c74a932200c97918837541a3003fd51c35b5195575a8125cba99
- SSDEEP 24576:1I1lwH8OhQfK56rsJ5/6vNtdTaZ+s57xjRaSDMiA2PqCW+9M:fcOCfY6rsP/IaZx57xjRaUMiA2Pq+W
- TLSH T14BB59D2EFE909DB9E5620031CAB4E75D1229BD310B2191C7B298761DEE31FC26E35B17
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\compact.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\proquota.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\find.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tree.com 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral2/memory/2352-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002600000002b0bb-5.dat upx behavioral2/memory/2352-1429-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2352-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.22000.194_none_841924fc9a413271\wimserv.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.22000.1_none_c5fd122e0036c04c\EdmGen.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\f\SpeechModelDownload.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\r\PkgMgr.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15806.256_none_4e9ea93e588a5995\aspnet_wp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\XGpuEjectDialog.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\f\SearchIndexer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.22000.120_none_3da444c93fbedacf\f\OOBENetworkCaptivePortal.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\msinfo32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\r\SpeechModelDownload.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.22000.1_none_22807c6d6dadd33a\upnpcont.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchIndexer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\r\securekernella57.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_f8757a3e115338fd\r\Microsoft.ECApp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\f\NarratorQuickStart.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.22000.1_none_21c411966b3ba1f5\nslookup.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\WebExperienceHostApp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.22000.1_none_693149fc921dd27f\rrinstaller.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\r\spoolsv.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.22000.1_none_d9e8af91dd649cea\UserAccountControlSettings.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.22000.1_none_62466b235333f53a\dvdplay.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.22000.1_none_bba9eafbb68c1dfb\rdrleakdiag.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.132_none_7958838972f5ba04\LaunchWinApp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_16fdfdd9b45d6e53\waitfor.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.256_none_f3055d6fbd1168d8\ngen.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\SyncAppvPublishingServer.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.22000.51_none_2158495b1874d95c\f\services.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\f\LsaIso.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\TextInputHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\winlogon.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.22000.1_none_53e9c4cb2f33e8c8\systray.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\setup16.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\r\Robocopy.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_397d6ed60254bd95\PackagedCWALauncher.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\r\BioIso.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\ScreenClippingHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.22000.1_none_50931f3c57820a75\cttunesvr.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpconfig.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\f\wkspbroker.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.376_none_2a06005b3bb58976\appidtel.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\winresume.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\r\FsIso.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.1_none_40fab150342df168\refsutil.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\r\Microsoft.AAD.BrokerPlugin.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\f\wkspbroker.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.132_none_e66ce03b0132db6b\r\systemreset.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.22000.1_none_38b7c0094d09fcbe\hdwwiz.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_b563dd17654ea05f\cmmon32.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.22000.1_none_d18b284aa244a1ec\backgroundTaskHost.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\RdpSaUacHelper.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\f\Microsoft.AAD.BrokerPlugin.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCncProxy.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.469_none_59f2db2aeb94e019\f\WpcTok.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\r\SystemSettings.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.282_none_3891f56e17aabe62\f\lsass.exe- 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_2520e3bf144caff3e5bce0cd4f6bbf9b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.7MB
- SHA256 0fccd4f1837199544f6889ce0f847ae211e18c3ed6947ccd7b16f16b493ca703
- MD5 fe581a593478b542269f221fe25bb372
- SHA1 dda6ef275f9eb40f4eebeaf7189907397510c83d
- SHA512 65e5147f6697afdb957d2b1ed8061e6a4ae83650ae5c5653164a71ee46fb078fa9ce8095cfeb993293718984caf4aeb814bd4a8e688ee34f22440ad0f7d41787
- SSDEEP 49152:fcOCfY6rsP/IaZx57xjRaUMiA2Pq+8Pji0Ajx:f2g1PTJxjRXzEjo1
- TLSH T125D57C2EFE608EB9D0724071C9B5E75DA6357D210B3185C76288B62CEE32FD25E35722
- MD5 SHA1 SHA512 SSDEEP TLSH