Analysis
- max time kernel
115s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 03:56
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.0MB
- Sample260424-ehrazset3w
- SHA256 a2bbbd29f14a2b0f47db5f4351e304db8587e3cb6cd2b0e3692a851bc3cb9f4a
- MD5 ff134330e27d01dd007ccf7702f3ff65
- SHA1 0942e36bc839a2ae354850e20e34d3e2c36bbc01
- SHA512 a4ee80c431871340da44982ec583c24c268ad91151a0c7ebc6213f84c0d743393d80423cb24205be8f2e366638915ea1d527da5450b055b972980f7b83e3ba78
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rX:4K5N55sgjOk9WO1rutarX
- TLSH T122E56A1677988FE9D86F4135CA654231A6777C211F21E3CB2258AE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2976-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b38d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2316-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a190-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0055000000028a90-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028dc8-1248.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2976-1335-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2316-1336-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a5f7-1487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000025ae1-2036.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2316 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{7D4668E7-9A84-4825-A94E-3FFCB96DCA7A}\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2976 2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 2316 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_ff134330e27d01dd007ccf7702f3ff65_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 a2bbbd29f14a2b0f47db5f4351e304db8587e3cb6cd2b0e3692a851bc3cb9f4a
- MD5 ff134330e27d01dd007ccf7702f3ff65
- SHA1 0942e36bc839a2ae354850e20e34d3e2c36bbc01
- SHA512 a4ee80c431871340da44982ec583c24c268ad91151a0c7ebc6213f84c0d743393d80423cb24205be8f2e366638915ea1d527da5450b055b972980f7b83e3ba78
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rX:4K5N55sgjOk9WO1rutarX
- TLSH T122E56A1677988FE9D86F4135CA654231A6777C211F21E3CB2258AE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.5MB
- SHA256 567ca41270e4f6ff34b58a1367d90d8557737336e4e00da76d7f0b21aced8f04
- MD5 bd172e25114f738595dd2a9ac4ba7abb
- SHA1 b096f90affb35bfd80873a2ed13b9debb72bd09a
- SHA512 46d5ac8943ab25ee0aa3bfbeee35bcf6f83ce6ef3dbd2f6515a626e54a57e18933f71ea24c463a2e3a51aa41a3963baeaad784e03961a6c7cdd5fa00ba360f48
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rXU:4K5N55sgjOk9WO1rutarTCqo
- TLSH T155F56B16B3984FE9D87B4135CA654221E6777C211F21E7CF1298AE2D3E32AD05D3AB13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.5MB
- SHA256 c760705858d515ace2e933aa3bc334d3d0c567b9a641f69ad9f453dff060b709
- MD5 ff4b01c85041417ce410842630cb238c
- SHA1 3f119fdb98095e92af4fed998c97d7bd3c68d65d
- SHA512 d3a7f83aaeb0051521a8ba8fe15ef04e2a44b49b5272429a43b9b5eaf18c3aa0c6aedeb393fae0099aefde67b58dd2fb25606684f4e7944295df92d9d4cf8dc8
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rTO:4K5N55sgjOk9WO1rutarLjo
- TLSH T1DB066C16B6A84BF9D87B8035C5A15265E6737C211F20E7CB1258EE2C3E32AD19D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$
- Size 3.0MB
- SHA256 e84bd36785224ed2212e187572a85cee2ae2300001f8095a03bf67c078bb3bad
- MD5 6a685e7ca945d081490fbda05bfc9fbb
- SHA1 c5ca073877e4f1f20d08eac743af483e755f8fab
- SHA512 1d16762661a3fdef6dacce08441af9f881c975344aaa3a4d23b5588bbe1771fecf87c6d621b6ca84345cb83372d48c06f81e4a95c7e9ddcf397a0942581cc62a
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56r0:4K5N55sgjOk9WO1rutar0
- TLSH T132E56A1677988FE9D86F4135CA654221A6777C211F21E3CB2258EE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.1MB
- SHA256 4face60b4fe376791571f26a9be25047febfd121089d59763a80a0b3db73d8cc
- MD5 860b546be73c1475df73b47d815487fc
- SHA1 8677225c6fad017b29b8dfbd802aebebce71174c
- SHA512 bb6510304513a13aea259e795e5af53ff182504a451ca9dc723a722e912a7339c8f4dbcf666b084ea91aa1c9899a1cd0749923aad0a52993e32c7fcb79719255
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56r9:4K5N55sgjOk9WO1rutar9
- TLSH T160E56B1677988FE9C96F4131CA654221A6777C211F21E7CB2258BE2D7E32AC06D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.3MB
- SHA256 5ff7e5da38e5d2ad8f0954baf04a01308f12a0396198d39be5ac3b33b9bdc516
- MD5 d12d99f79e06527321b8781418dab655
- SHA1 47073e04715bd3ff04902f45faeb2646082d7264
- SHA512 a24cd0a82611f1fec99ad96e2b8cc81b601c232ad122d000ccbbcaf5d5014f88aff5721d61f756e4a8b7b2dd5dda302da2e27357f10eac78ccfdc1dec52766ed
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56ruy6i1zuajsauZnJp56rPA:4K5N55sgjOk9WO1rutarPuX
- TLSH T127F57B1277984FFAC86B4135CAA54235A6777C211F21E3CB2258AE2D7E32AD05D37B13
- MD5 SHA1 SHA512 SSDEEP TLSH