Analysis
- max time kernel
84s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 16:07
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe
- Size 3.5MB
- Sample260423-tklkvaat2s
- SHA256 5b23f3fad2b87ef13358d083e395589815ff06ce5b1d9c60d9fae63c5b247df7
- MD5 337d83c7e87a37fcc6bbedc500231d0b
- SHA1 7bf36609be7c7c1e58fe13f35794c3b940dbb4f0
- SHA512 01be878a7a6ac6cbae1536645609d73874b49a73c95c2db838a28075a4572507894f76938c6c4b4be1308158d27480e57828d4d5b2bf419d21298cf020f227d1
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAf:BCL3IR8DydB3Io3W1PszNsQEpYq
- TLSH T18EF5071DEEEA8E12CC7124708F3D979C45203EA01BA1C59B6694752DEA33F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 8 IoCs
resource yara_rule behavioral1/memory/5012-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024417-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3360-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229d9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002320b-1264.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5012-1350-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3360-1388-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001dc33-2039.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3360 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5012 2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe 3360 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_337d83c7e87a37fcc6bbedc500231d0b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_icedid_remcos_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5012
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3360
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.5MB
- SHA256 5b23f3fad2b87ef13358d083e395589815ff06ce5b1d9c60d9fae63c5b247df7
- MD5 337d83c7e87a37fcc6bbedc500231d0b
- SHA1 7bf36609be7c7c1e58fe13f35794c3b940dbb4f0
- SHA512 01be878a7a6ac6cbae1536645609d73874b49a73c95c2db838a28075a4572507894f76938c6c4b4be1308158d27480e57828d4d5b2bf419d21298cf020f227d1
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAf:BCL3IR8DydB3Io3W1PszNsQEpYq
- TLSH T18EF5071DEEEA8E12CC7124708F3D979C45203EA01BA1C59B6694752DEA33F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.0MB
- SHA256 36f6de9947c6804ae9df2824111bdb10fd0bcc71bb05a89dc2f0a56284ea64c5
- MD5 42e429174dfdc639ebd8e06eb9d7e0ba
- SHA1 d85d35c761374c1d9a94f453ee4d62e6c3268de4
- SHA512 9a9937243c3351487109da1a38bcba2cae2108e407e9f1f85c022f59958856a6a2b6c30018ca8a47cdc987627010d3ea050b915647abdd0c3f4d838083cc07dc
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYqjPji0Aj:YjIiDWCo3W1Pszo6Gjo
- TLSH T1A616071DEEAA8E22C8715070CF79979C45303EA01BB1C5976694B62DEA33F89543F723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 3.5MB
- SHA256 941d3003d2c9ba7953663b60e29c440dd914cfef6623cef35bb979d16eeff657
- MD5 b5d3bad5e5b592baa3db3a1e03b7b79b
- SHA1 94996bf2ae45a49fb3c22c952da8c3dbd0b1ce63
- SHA512 e2a43049dd96ea593a467959e9c76a8cb15b1b35b26b0e756016124eb01966ff955f801570129cf96ae86c95c4ed335a6c640df1e786f153b6a8eccc2e79b300
- SSDEEP 24576:BCbvtJ1WAXIR8RrxzfadB3Iotwe6BavWrB1xetOsQuEZIG6+/GNsElnJnC15jcAl:BCL3IR8DydB3Io3W1PszNsQEpYqt
- TLSH T16C06F81DEEEA8E12CC7124708F3D979C45203EA01BA1C5AB6654762DE933F89643F727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.7MB
- SHA256 1231447659047eeaf074fe0ccd3e7f521be5af90e2c97abb5f257af7d216b131
- MD5 3819aadf13358859fcfca0d8212f6215
- SHA1 30346abcceafeacc14d9d4d6b9549e518ca754de
- SHA512 e3ad5b60fac08c714f813f1b83b0fc41c9d71dd6d9a11075f37faa7f992da3fb270a65006872c161b6c5c4a8a25207fa38ce1b505ad91961a24ed9730b0fcfac
- SSDEEP 49152:BCL3IR8DydB3Io3W1PszNsQEpYq/i2WH3:YjIiDWCo3W1Pszo6CuX
- TLSH T10706F61DEEEA8E22CC7124308F7D979C45203EA01BA1C59B6694752EE933F89543F727
- MD5 SHA1 SHA512 SSDEEP TLSH