Analysis
- max time kernel
80s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 17:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
- Size 2.7MB
- Sample260422-wer7jsds4k
- SHA256 e9148c128839e43da9574f6d2be99c0bad06351ef2f11cd06ddc1b9b4b644281
- MD5 ca45e291d2af56498946e3664cce3b01
- SHA1 885503e14307ac1f0d7d72c4fd92d5c7964c5a3e
- SHA512 115b5564048ed3dadba5fd6d7d17b78764b6de0226b6b3404e810a8c25e1d9eef3e230ffbedae873aa9a34ff3acf71c2bcb804751064a9d3961311689985e68f
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5W:HK5N55sgjOk9WOo65W
- TLSH T1F3D55B22B7A487FAE8738175C9A59375AA353C210B30E7CB5249F31C5E32BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/1480-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244df-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2456-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229e5-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244e5-153.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1480-1379-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2456-1416-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000743-1666.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000727-1940.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2456 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1480 2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe 2456 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_ca45e291d2af56498946e3664cce3b01_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1480
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 e9148c128839e43da9574f6d2be99c0bad06351ef2f11cd06ddc1b9b4b644281
- MD5 ca45e291d2af56498946e3664cce3b01
- SHA1 885503e14307ac1f0d7d72c4fd92d5c7964c5a3e
- SHA512 115b5564048ed3dadba5fd6d7d17b78764b6de0226b6b3404e810a8c25e1d9eef3e230ffbedae873aa9a34ff3acf71c2bcb804751064a9d3961311689985e68f
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5W:HK5N55sgjOk9WOo65W
- TLSH T1F3D55B22B7A487FAE8738175C9A59375AA353C210B30E7CB5249F31C5E32BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe
- Size 2.8MB
- SHA256 8cc71c08d9eb20cceee2c7da604de770f727f7175fd6f985a40a535cdb32e835
- MD5 b0d95d7703f35a52ff425c1d281281d5
- SHA1 ab40b28043618bec9566565d31afb80685aa67e8
- SHA512 bc4e884c6595e5fbdee2d58db10e317ded213a6c947b685c968bdb73f2f9dcb24abf8c845f16484d4598646f9652239762f7324722eb676a089f5b683c1ca865
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5YI:HK5N55sgjOk9WOo65YI
- TLSH T15FD55B22B7A487F9E8738175C9A59375AA367C210B30E7CB5249E31C1E32BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 27be035d995791d9824137fb68958dbba776d32430e063cdab523563cebec263
- MD5 7c11a7b375e02a2812c8aa3f81f902e6
- SHA1 cbb951d169a76b21957f13675a0317dd2cf39a44
- SHA512 0df0c086428e1404f5e03d2d630a21ba4c27f581e9a4833f72850b5330dc2c6605c9cba9f48dc7aedfa8027a947eb6222db579326ed96ee8adeec3b05afa8218
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5WPji0Aj:HK5N55sgjOk9WOo65sjo
- TLSH T178F55B22B7A487F9D8738175C9E693A5EA3138610B30E7CB5249E71C1E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.8MB
- SHA256 51c03a843c818d81ff959ff3f46f9dd63842599bc4be1120cf016c5f5cd5de5c
- MD5 d9685ff9142b9e372bdecaee79d6bf37
- SHA1 dcb159869d1b51723407e6229ebdb38682127fc4
- SHA512 9d6d025217822a33bcc8bca1b85c159d2dfccbc2ba10be7a5f4c5a168724323a9e3d10846a50c5f3530bfe44a29f1f3e0ba8b247cabf98892fa5339f39d0864b
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5L:HK5N55sgjOk9WOo65L
- TLSH T151D54A11F7A487E9D87B4175CAA59365BA373C210B60E7CB5288F22C1F32AC19977723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.1MB
- SHA256 6465421fee02d5cae5264816caec7398677fb45374d12efd388e6361b5e5b59e
- MD5 c6c7dce304c91d321e4e74694b405ff9
- SHA1 d84b838d4d7b816edd9e426678b3cf7ea681134f
- SHA512 1b18e3c59499057d634a8bd505cda8804c23d968a4c03da1c0f7363ac7de0d33f48d83111857d88fcdb823155aea019796b06bbf6006d900d16fd936d96bc3bd
- SSDEEP 49152:Bd8e7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I0C5NXpiMh:HK5N55sgjOk9WOo65Npig
- TLSH T18DE55C12B7E486F9E9B34271C9B59365AA367C214F30E7CF1248A61C1E32BD1D937722
- MD5 SHA1 SHA512 SSDEEP TLSH