Analysis
- max time kernel
97s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/04/2026, 18:28
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 3.2MB
- Sample260423-w4pgysfs2w
- SHA256 bd673904a2abb510bff87822f81134cff952c50c24f1aa2dce5307dcb8d2df9c
- MD5 5fe801d6093533cea823d6c623fb6f68
- SHA1 97241f04660360e3063109fd77b0f145019351d1
- SHA512 a38bb635a2d0a5162e394f941fdd575d53017a789d2331b3fd249992d42271196fd3de6f1f6a24ec4155e96337acf75066e6db1d469de01aabcbcdd7b044bd3e
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9Mb:xK5N55sgjOk9WOoQfkZc
- TLSH T18FE54A12F67887B6D4B28075C5E6A769FA3238510B30D6CB524DE32C5E33BD29937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/1260-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024442-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1756-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229d9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002178d-737.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002163b-990.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e0c1-1343.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1260-1376-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1756-1443-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001a00000001e760-1511.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1756 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{45F8B51D-EABC-42F1-BB45-74C2DEEAB111}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1260 2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 1756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5fe801d6093533cea823d6c623fb6f68_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1260
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 bd673904a2abb510bff87822f81134cff952c50c24f1aa2dce5307dcb8d2df9c
- MD5 5fe801d6093533cea823d6c623fb6f68
- SHA1 97241f04660360e3063109fd77b0f145019351d1
- SHA512 a38bb635a2d0a5162e394f941fdd575d53017a789d2331b3fd249992d42271196fd3de6f1f6a24ec4155e96337acf75066e6db1d469de01aabcbcdd7b044bd3e
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9Mb:xK5N55sgjOk9WOoQfkZc
- TLSH T18FE54A12F67887B6D4B28075C5E6A769FA3238510B30D6CB524DE32C5E33BD29937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.5MB
- SHA256 c81732b40ddc70e1a4bf17080686dc6f1a494dd506fa81c2ad9af0130f973018
- MD5 45f5864e32564e5a4a0bbd57d8a98b4c
- SHA1 f4f35edd6cabbc1cec3fdd6158a44e77ffc75d6a
- SHA512 9db9fa095ae6fcfb10d97473cac3eee3c2f9b7c6f013c23871a0a4f647bcdb1d6f0dbafe3f73e97025162bf993d35fba03539234b52f2d6405b252928af95327
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9MbjUNw:xK5N55sgjOk9WOoQfkZcVE
- TLSH T1D6F54922B67887F6D4728079C9D6A769FA3238510B30D7CB5249A32D1E33BD19D37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 3.7MB
- SHA256 8dce68b76a81490fbea9164a5b44178313e2827a636855b73495498a6710bfad
- MD5 fb459d7a0780c80c0ebc811e707e3a6d
- SHA1 bec0aad83e91811278b79f277ea5a520d744181a
- SHA512 b07cdbe8ffcb088abafae13796f1a7b73a6f095dfda862fe34cb15a26ca69b38c0656dcebe456e694b9ab1be0e1018c29cfcc80e00378ebeec01e0bad39414cb
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9MbIT9w:xK5N55sgjOk9WOoQfkZc+2
- TLSH T16A065B12F67887F6D4B28075C9D6A769FA7238510B30D6CB1249E32D1E33BD19A37722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 473fe0942b5b3b1a87589774a63c5e85472de9e6226469544ec331a353881099
- MD5 6fa0ceadd075bd27a04e9f4f6fc3f586
- SHA1 5e9b37eca68b5be1e9626fb70cb870c713be52e7
- SHA512 70d0d6c52ab4e4c8a851879bb809f81ba24a103f66e4f0e32d232509b14245fadc1988afcc2dc9ef0e2f492e72c8382d2a39b1afae1fb031ea70040b401d2929
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9MbBPjy:xK5N55sgjOk9WOoQfkZcRjo
- TLSH T12A063A16F67887B6D47380B5C5D6A769FA3238510B30DACB5249E32C5E33BD28937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 3.6MB
- SHA256 8e34b32118430b829f62978def33f5326d767034c0a999bad8568172a9e3174c
- MD5 93583b7ea5afad013f0e854bbbe557a2
- SHA1 a70c2d57f4d252a4897548ffb9ec3fc13aa63fce
- SHA512 38b2116fb73db24b571324d628f3183b65274339d08014fcfc901f4ba25f184d12044c4bc037c8cdf4a682e0ea76804bd7e77064a83c19bb724317103ffa3f73
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9Mb9UO/:xK5N55sgjOk9WOoQfkZcn9
- TLSH T1C0064922F67887F6D4B38075C5D6A769FA3238510B30D6CB5249E32D1E33AD19937B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.7MB
- SHA256 d38611ff62af976a9fb77cb6beb84c211e38b5b878db364d1433aad78d202a7d
- MD5 905dfdd07112bd515c58c6339354c119
- SHA1 b7ce95f5f47a1258b91fb91ecbf914c0af82a22c
- SHA512 93eaf93258eb882ab3b70833ae77c8106a2dd2b137a5f872977d7f20b8c55b9432db956a754ce28ca35345c8750b1f2f154d7ac9bec0bd591a16b61fd936dcd3
- SSDEEP 49152:B7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2IJFeW4SkZP4sz9MbL8tJ:xK5N55sgjOk9WOoQfkZcLm
- TLSH T15A065912F67887F6D4B28075C9E6A7B9FA7238510B30D6CB5249E32D1E33AD18937721
- MD5 SHA1 SHA512 SSDEEP TLSH