Analysis
- max time kernel
116s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 17:09
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
- Size 3.1MB
- Sample260423-vplbbaaz2m
- SHA256 c2aafee761b235cd49967f619d9982943716cfe43a44876e87e8cc16520e6900
- MD5 11f675db4d50e898940efaf995e0eac4
- SHA1 b154ec4ca1c047ba02d25c99dbd5a7e3a108904c
- SHA512 43f3ce101e04468acc72ada07458f47ee43b9483e79487e48ab8d1f9fd845dc854e4a49ea2f11bfbd22f90ca04e60f85f05072857b0a292418b6e14b712d9eb2
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0Aj:xK5N55sgjOk9WOoZAjo
- TLSH T1F7E56D12F66487F9D8738075C9E29769EA7238510B30E7CB5289E32C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/1316-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b477-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/592-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a1be-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1316-1024-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/592-1043-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028df7-1248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025e95-2013.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 592 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1316 2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe 592 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_11f675db4d50e898940efaf995e0eac4_amadey_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1316
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:592
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 c2aafee761b235cd49967f619d9982943716cfe43a44876e87e8cc16520e6900
- MD5 11f675db4d50e898940efaf995e0eac4
- SHA1 b154ec4ca1c047ba02d25c99dbd5a7e3a108904c
- SHA512 43f3ce101e04468acc72ada07458f47ee43b9483e79487e48ab8d1f9fd845dc854e4a49ea2f11bfbd22f90ca04e60f85f05072857b0a292418b6e14b712d9eb2
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0Aj:xK5N55sgjOk9WOoZAjo
- TLSH T1F7E56D12F66487F9D8738075C9E29769EA7238510B30E7CB5289E32C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 1b7244246f626c5b3285e6d232f090cc4bbb376be9e88b693b6109d1c6e094b6
- MD5 96698a568d1c8b3a983ceed31b1fc93c
- SHA1 42f933627beaca7c2de18912ca335052b271090c
- SHA512 f7cfe0bdaf2c016b437028fccf938534e3d65fa47cd75eaab619ade3b0d8d9f566d7629fb1335dbc5f170f326de8c1d5e9b65ee77bc4facd6e4c7bdf5c64741c
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjKPji0Aj:xK5N55sgjOk9WOoZAjo0jo
- TLSH T153066C12F66487F5D473C075C9E2A769EA3238510B30D6CB5289E72C6E33BD29937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.2MB
- SHA256 3f695c5db4a1b98161080d3f76325a02880750df4a1b571eacd50c298684ce36
- MD5 efaf8bc449788582c5ad22938758a240
- SHA1 1ad0604c76f5e068c61cf1173488d5278022c765
- SHA512 2d7986c771977b9407286fc5a515b4ac657e80d1627a2adbc9703360f25de5f1514e1636d75271c3b1cc4ec474d37443a1d6d23600ba939c178d05b3f27d545e
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0Ajq:xK5N55sgjOk9WOoZAjo2
- TLSH T132E56C12F6A487F9D8738075C9A69765E9323C510B30E6CB5289F32C5E33BD19937B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.3MB
- SHA256 f0d51d75b925457ed7066fc0f2e82293209e396ff9c5b24c2c47619a314d288b
- MD5 0865f5ce9dee42542a8db4038672e495
- SHA1 589aa2520b120642ebf70ef8088e4475e1ddd335
- SHA512 09059209a76271f0810ac5e68620288edcef16ec550ed85fc45401020889616e1ab2e07c849f9f95cd5ac62ca807f9d7e0831491c290b12bfbf9e60cf7a113d1
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IKhODPji0AjYi2WH3:xK5N55sgjOk9WOoZAjoMuX
- TLSH T147F56C22F6A487F9D4738075C9E69369EA3238510B30D6CB5289E32D5E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH