Analysis
- max time kernel
120s - max time network
109s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 03:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.0MB
- Sample260424-ehrazset3w
- SHA256 a2bbbd29f14a2b0f47db5f4351e304db8587e3cb6cd2b0e3692a851bc3cb9f4a
- MD5 ff134330e27d01dd007ccf7702f3ff65
- SHA1 0942e36bc839a2ae354850e20e34d3e2c36bbc01
- SHA512 a4ee80c431871340da44982ec583c24c268ad91151a0c7ebc6213f84c0d743393d80423cb24205be8f2e366638915ea1d527da5450b055b972980f7b83e3ba78
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rX:4K5N55sgjOk9WO1rutarX
- TLSH T122E56A1677988FE9D86F4135CA654231A6777C211F21E3CB2258AE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/4112-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024444-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4664-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e74d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030a-340.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00170000000216ac-1213.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202a7-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4112-1432-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4664-1463-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4664 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4112 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 4664 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4112
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 a2bbbd29f14a2b0f47db5f4351e304db8587e3cb6cd2b0e3692a851bc3cb9f4a
- MD5 ff134330e27d01dd007ccf7702f3ff65
- SHA1 0942e36bc839a2ae354850e20e34d3e2c36bbc01
- SHA512 a4ee80c431871340da44982ec583c24c268ad91151a0c7ebc6213f84c0d743393d80423cb24205be8f2e366638915ea1d527da5450b055b972980f7b83e3ba78
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rX:4K5N55sgjOk9WO1rutarX
- TLSH T122E56A1677988FE9D86F4135CA654231A6777C211F21E3CB2258AE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$
- Size 3.3MB
- SHA256 2302e84bfcf9ffa5b0b8d04c20f78ca3ffcdc6777f5547ee33272933dcd1db46
- MD5 6561a2b84113baf191fb001285cf1488
- SHA1 4217bc318f1e0082d0397d5699ae0031a2afc86c
- SHA512 a6be1cf535017eb40560f6a3fcce3b57e89e1bf15c5a8c797ded9e63d4e162b1e3486c5230adc249db22538b01d2168f854f4f6d0422b0302b9027193375ee91
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rkb:4K5N55sgjOk9WO1rutarVI
- TLSH T1F8F57B1677948FF9D86B4135CA654225A6777C211F20E3CB2358AE2D7E32AC09D3BB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 c760705858d515ace2e933aa3bc334d3d0c567b9a641f69ad9f453dff060b709
- MD5 ff4b01c85041417ce410842630cb238c
- SHA1 3f119fdb98095e92af4fed998c97d7bd3c68d65d
- SHA512 d3a7f83aaeb0051521a8ba8fe15ef04e2a44b49b5272429a43b9b5eaf18c3aa0c6aedeb393fae0099aefde67b58dd2fb25606684f4e7944295df92d9d4cf8dc8
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rTO:4K5N55sgjOk9WO1rutarLjo
- TLSH T1DB066C16B6A84BF9D87B8035C5A15265E6737C211F20E7CB1258EE2C3E32AD19D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$
- Size 3.0MB
- SHA256 a29e588ebfd52ff07b29849bdd10f25cff975033b3abda99c94e88f9e875426a
- MD5 2670eb8f31f8aa6511c212ddf7d03512
- SHA1 8ea5b3e599ed8b9ae4235fbb1938829bc9d60831
- SHA512 41da692f98a1f1132ac53329308bb5bf3896e649b3a9ae112b6a7885758acbd3003c57ae301f489e336ea3ae0a03baa4446dd0fc19805b90618ab7814ac85097
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rO:4K5N55sgjOk9WO1rutarO
- TLSH T1EDE56A1677988FE9D86F4135CA654231A6777C211F21E3CB2258AE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 3.1MB
- SHA256 4face60b4fe376791571f26a9be25047febfd121089d59763a80a0b3db73d8cc
- MD5 860b546be73c1475df73b47d815487fc
- SHA1 8677225c6fad017b29b8dfbd802aebebce71174c
- SHA512 bb6510304513a13aea259e795e5af53ff182504a451ca9dc723a722e912a7339c8f4dbcf666b084ea91aa1c9899a1cd0749923aad0a52993e32c7fcb79719255
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56r9:4K5N55sgjOk9WO1rutar9
- TLSH T160E56B1677988FE9C96F4131CA654221A6777C211F21E7CB2258BE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH