Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 19:41
Behavioral task
behavioral1
Sample
2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 9.7MB
- Sample260423-yeazdaft8j
- SHA256 7ae4912fae1326cb2947a373b96de9a00996e8e9d43024be5c3689f343d1e372
- MD5 e4de01b0654a3f3eff900fa94245895b
- SHA1 0c29f500ea3b0e3ba9f1561a1fb574771251c682
- SHA512 3e49667022aed379d1f9627bc9c9ebd65acc46781f4f677a51bf66f1394c45c1ce99930f0b93d5ec586da63ea73f3da76b7b160a33da7f49cd8df5b2b551ce8b
- SSDEEP 98304:Hr9FMByVPKAy1PTJxjRXzDUbYZfgs0Qlxvdm:L9E1LdzDU64sfdm
- TLSH T19AA65B15BAA444F5D0A2C234896287AEE2717C158F329B8F1191BA9EBF73FD14D39331
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\finger.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\runonce.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\help.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe -
resource yara_rule behavioral2/memory/2956-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001f00000002b172-5.dat upx behavioral2/memory/2956-579-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2956-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_d7d3a12b5c67df85\iexplore.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.22000.41_none_1d0a15319901359b\r\PinEnrollmentBroker.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_f6a11a34378fa70f\r\StartMenuExperienceHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\wowreg32.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\r\DataStoreCacheDumpTool.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\wsmprovhost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15806.0_none_eb7fe9dcc519b26e\Microsoft.Workflow.Compiler.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\SearchFilterHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\n\SenseCM.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\r\IESettingSync.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.22000.1_none_140b0d3e9e73ad81\wslhost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.22000.1_none_6c676f39acc16196\InspectVhdDialog.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.22000.1_none_132662a9c55e557b\attrib.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\AddSuggestedFoldersToLibraryDialog.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\LockApp.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_c5af807aa8d61858\gpscript.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\SyncAppvPublishingServer.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\SyncAppvPublishingServer.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.469_none_647b90a512106929\r\winresume.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\f\WindowsSandbox.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.22000.100_none_c98e4ba1fbb1ffd8\WorkFolders.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.22000.1_none_ad99ec61bd0e5b20\at.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.22000.1_none_5a83adc24ec7ef66\takeown.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\SearchIndexer.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.1_none_9b404ac522e88eb7\MDMAgent.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_4a72530ae0a1ba07\regedit.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\f\InputSwitchToastHandler.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.22000.282_none_c161005c63dc5d29\Windows.Media.BackgroundPlayback.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\f\RMActivate_isv.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_a8651901944b2dc3\poqexec.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\mighost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_6e6aca3ab1161ee5\pcaui.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\WerFault.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\tracerpt.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_3f4beb1e121a63d1\RegSvcs.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.22000.1_none_69f4002fb9e8f9d3\powercfg.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\BrowserCore\BrowserCore.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.469_none_40856ba085a100c4\f\BioIso.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15806.0_none_5b1bda6d9e3a1e5c\DataSvcUtil.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_397d6ed60254bd95\PackagedCWALauncher.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\mount.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.22000.1_none_b15540a9822b5c00\rdrleakdiag.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\AuditShD.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.22000.1_none_05f7f490e9af5ded\MicrosoftEdgeDevTools.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\SearchHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\f\CheckNetIsolation.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_c0393e363102a7bd\netsh.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\r\raserver.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\r\winresume.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\change.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\chglogon.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\dtdump.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\userinit.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.22000.318_none_92049afacb4417d8\dtdump.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.22000.120_none_9268b7169b04c4a6\ClipUp.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.22000.1_none_0e60d27e3653c64e\shrpubw.exe- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.22000.1_none_54e342fafa4dc4d4\DWWIN.EXE- 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_e4de01b0654a3f3eff900fa94245895b_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.2MB
- SHA256 ae6dbf3a09ab65b6b64a2fb10174de5c89ddd15e54a40b46af4ee1ff9e1dc4cc
- MD5 8576d86c933271169bf11fc680bce45d
- SHA1 11ffaed5740cdbf7eb6d084e385412479d3b8ee1
- SHA512 5b74e99e6f46e6e1b84653d1a5bc6c87f620bb11360f59d76635026b554e2204b371f97a46c7542241efff66c18fa301152585dbd8a430c02d80d9376f2d791a
- SSDEEP 98304:Hr9FMByVPKAy1PTJxjRXzDUbYZfgs0QlxvdajoV:L9E1LdzDU64sfd8oV
- TLSH T1ADB64B15BAA445B5D0A2C23489A287AEE6717C058F328BCF1151BA9EBF73FD14D39331
- MD5 SHA1 SHA512 SSDEEP TLSH