Analysis
- max time kernel
80s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 17:15
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 2.2MB
- Sample260423-vs1keact6s
- SHA256 5e5be9c01bcb4b1988b05cda88caaaae195d21823ab8df41bb208b85b905b013
- MD5 179143bdc9bf9c238a1e435de79c606c
- SHA1 5f4138e928045c540c46ac3feba03f38d34e6295
- SHA512 8f9c7c84546af0fbc1b539450a78c55edd72594e52f4d7e79e6b49266bb9ac5ace04287c7587ac7818298f6886e1d74d239bd46f640c026694d6c9e114afbab4
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rX:hK5N55sgjOk9WO1rLrX
- TLSH T147B5051276448FF9C86B0131C965926CA2677C218F13AFC76258BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4676-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024477-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4708-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229da-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4676-1374-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4708-1441-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0016000000020244-1448.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d000000021834-1587.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000006d1-1864.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000000729-2035.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4708 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4676 2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 4708 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_179143bdc9bf9c238a1e435de79c606c_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4676
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4708
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 5e5be9c01bcb4b1988b05cda88caaaae195d21823ab8df41bb208b85b905b013
- MD5 179143bdc9bf9c238a1e435de79c606c
- SHA1 5f4138e928045c540c46ac3feba03f38d34e6295
- SHA512 8f9c7c84546af0fbc1b539450a78c55edd72594e52f4d7e79e6b49266bb9ac5ace04287c7587ac7818298f6886e1d74d239bd46f640c026694d6c9e114afbab4
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rX:hK5N55sgjOk9WO1rLrX
- TLSH T147B5051276448FF9C86B0131C965926CA2677C218F13AFC76258BE9DBFB1AC05D27633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.3MB
- SHA256 0b36e68e77a5e0cc7d5da6ff23169c1960250669e8a975613aa8af5d74127a7e
- MD5 68b655f9c753746a78f55c47dc5c9e3b
- SHA1 23596f7143d528022d7dcd9f5bc9fe358851ac50
- SHA512 014fad613f9e6f6e06a6362b28aff3c536511708b76a3d8aa3d3a8a5c140c77492f392e57471f2cc81d6aa903901bdebbbba32ee1b6c2a70a6df5d9f5266904d
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rDW:hK5N55sgjOk9WO1rLrDW
- TLSH T1EBB5061276548FF9C86B0131C965522CA2777C218F13AFC76258BE9DBFB2AC05D26633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.7MB
- SHA256 7349a81d0f6527b21c4ccb498f28eb0d574c35be7cbd62172a6a026888745d25
- MD5 38b46c76a48fb3bed75429485c5266a5
- SHA1 c815d39fbab5aa98afad763dae93a9eb59b474eb
- SHA512 e3fb95a29ad46b4133a310073b2a73c96391abb07fb0ef2078a4d4ff9501ae96b94bfb26cc364f1b385e5b7a1883d1f8c18877ed5109094d26030612b7a7df6d
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rvUidGl:hK5N55sgjOk9WO1rLrvdGl
- TLSH T125D54A1276548FF9C86B0130C9555268A6777C218F12AFCB1298BE9DBFB2AC05D37633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 2.3MB
- SHA256 2f17d9a0c272e87ea548a0f12bc2c7f41aca8e9fccb6a8f22d9acdb3b33f4d17
- MD5 7709ce733c0052f5e934dd191a3cf29d
- SHA1 663a629086c68f1d1155620017c19fcdb2939468
- SHA512 99a2a6dfcd419473d1f43ea06c4fab0b3bf5086d8b07bde008d24e945b18954c856ca87e3c8cc68997b75b3a65d2dca28a45078269e853dd5477563ab4d6b178
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rNw:hK5N55sgjOk9WO1rLr2
- TLSH T1F6B5161276548FF9C86B0130C955926CA2777C218F13AFC76258BE9DBFB1AC05D26633
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 798433bfe71e64c1191b9f435b3ae3b581ea43ee0605cc2eb17aa96c758d831a
- MD5 6ab49c3b3fdb6bbdd0bbad2c3048df73
- SHA1 34936e68755d177c95049725bffc8edec5133c74
- SHA512 e56211cf6d2d91616b5653d3c91def4ec085c6ee2c90e43758238870f6305b0a87f1e7167196e485eb5dc6e23be6b65a0c2f87f86e98d4da6c698fc283ad2001
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rTPji0Aj:hK5N55sgjOk9WO1rLrLjo
- TLSH T173D53912B6548FF9C86B4035C591926DA6373C118F22AFC71248AE9DBFB2AC15937733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.5MB
- SHA256 de426208affc2e0d1aeb842fbbdab782106e0df1ea9fb23f0f0a401d6f1f6e09
- MD5 1792b944de37a8e4ff9260c23e08ecc9
- SHA1 1c30c9692ec1abd9203e50954056383daae345d1
- SHA512 bc4d0b76cf698c4ecc7de68df88c50e310c5718a67b88994b9884f53394213b2dcf75534e90760b2a065e89e7907b58588d86e0d91f7342945e207cbd314ab92
- SSDEEP 49152:BedCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56r+56rPi2WH3:hK5N55sgjOk9WO1rLrPuX
- TLSH T15CC5171276548FF9C86B01318965927CA2777C218F13AFC76258BE9DBFB1AC05D32623
- MD5 SHA1 SHA512 SSDEEP TLSH