Analysis
- max time kernel
87s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 14:04
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.3MB
- Sample260424-rc975acy31
- SHA256 05cc950c449dbd70c9b209c63727f9b3d54a247084b18120f8b04c3da5b1fa86
- MD5 b8f45a7df956a7e0c8a990e177632066
- SHA1 4f55b61598b8ef4804f04775cbb7c9d764b3dee3
- SHA512 481027aeeaddc9302d0d597b26d29cce7eda0c161c85686ab523ee1b6049d1472c068e9c3120cbd93dd39c0ebc313923fbb5d142c6db3961fed6facbd7b70145
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9Mb:WK5N55sgjOk9WO1r7joyfkZc
- TLSH T190F53A11B66487B6C4738075C596A76DE6323C018F229FC71249AF9CBFB3AD18936732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/3496-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024319-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1580-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000229f0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024325-799.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000002242c-1236.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3496-1375-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1580-1430-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000202b4-1491.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1580 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3496 2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 1580 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_b8f45a7df956a7e0c8a990e177632066_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3496
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 05cc950c449dbd70c9b209c63727f9b3d54a247084b18120f8b04c3da5b1fa86
- MD5 b8f45a7df956a7e0c8a990e177632066
- SHA1 4f55b61598b8ef4804f04775cbb7c9d764b3dee3
- SHA512 481027aeeaddc9302d0d597b26d29cce7eda0c161c85686ab523ee1b6049d1472c068e9c3120cbd93dd39c0ebc313923fbb5d142c6db3961fed6facbd7b70145
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9Mb:WK5N55sgjOk9WO1r7joyfkZc
- TLSH T190F53A11B66487B6C4738075C596A76DE6323C018F229FC71249AF9CBFB3AD18936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.8MB
- SHA256 63fad17b09bf04aabd4339c07c0e2a34301bea42d800db82069895076d09eef6
- MD5 b3176e5f10745a03916d7a91db62673b
- SHA1 9d03abd88cc026ff5dbd8ba915e8f67e28f6ed5e
- SHA512 48c9230f84adb40c95c33e8a41b66a7a903033083dd3836531e809b2173073747097a1abb2fe2a4c70502e185ddc308184a07abd7784f1f560ae8bda5a3e82dc
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9MbVTQ:WK5N55sgjOk9WO1r7joyfkZctCqo
- TLSH T1A2064A11B66487B6D4738075C592A66DEA323C118F22DFCB1248AF9C7F73AD18936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.9MB
- SHA256 258d3499a4192afd26fe45db9aa7b234e319b307d5c0c3b07e8bdde367db9f9a
- MD5 fe3a35a6b8b1b45b48ec3ea42dfbec8e
- SHA1 022d863308b27969b1331b5a7eec8244a117714d
- SHA512 5b778b955f182ea4a94dfa75f49d066d23e2ea77a463f7a5b9f0fbea7c8ddfb05bbd2da74e93f3c9a758656f21c1cd8857ec5b6a5b372af3d5790f5a61fb7da3
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9MbBPG:WK5N55sgjOk9WO1r7joyfkZcRjo
- TLSH T101163A11F66487B6D4738075C5D2A76DEA3238418F329BC70249ABAC7F73AD18936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
- Size 3.8MB
- SHA256 7ff1b37af15e796a5cee7e726068add59113ef3167af59cd286b97315e4996b5
- MD5 e6df19069e7d51eaa8264e2549b0006d
- SHA1 123bb243e4805b69c8e9ef1fb429c6272601edd0
- SHA512 39fefc31a956ef986f088c0e47dee7af02724e7cd142d591f9e9080f3f671dd17bc9477ee1127c4aa62ebf6ad9d20a4d667deb2ea7df7b6f56a9780759433285
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9Mbp4z:WK5N55sgjOk9WO1r7joyfkZcp0QA
- TLSH T108062911B66487FAC8638075C5969679E6323C018F22EBC71249EB5CBF73AD18937732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 3.4MB
- SHA256 5fc201600a7ccc2f3ea40499cb931cff26f70bc71967e3693380237af2630b6b
- MD5 4fad4a7e2bfad37511b94303e0debeeb
- SHA1 ec41f46bfc6a1907bb4b9469ef59d79088927b66
- SHA512 3b27a86a7af50e1acf41c26828b7e41869276d62b7f88aee98c49f72a58b39d1b96d7ac955a0138aac6d7041229f80d73eb1ebbbe1394704a52d081dc61643c8
- SSDEEP 49152:BdCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOY56rjPji0AjWeW4SkZP4sz9Mbj:WK5N55sgjOk9WO1r7joyfkZcj
- TLSH T171F53A11B66487B6C4738075C996A76DE6323C418F229FC71248BF9CBF72AD18936732
- MD5 SHA1 SHA512 SSDEEP TLSH