Analysis
- max time kernel
111s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 02:49
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe
Resource
win11-20260130-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe
- Size 2.9MB
- Sample260425-dbf11adt21
- SHA256 c2008d71d897c66d4582dd6012fbd0b8fe90216db478b0f287facee0488fde24
- MD5 9014bd56fa5650f6b521213b5b190f5f
- SHA1 ee6c9bdcc99c9e4d94f3df09af85c2b62915c6db
- SHA512 fcdfa55b272abe615e6dfae63d15b9562729373ed585ef61d9ed0a2ad83a976aaa643008fa7072b1cb82ec704c925c78e4441381735ea0a2918a48c13a5e1d9d
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2I:4K5N55sgjOk9WOoK
- TLSH T16EE55B22F66487FAD4738075C9E2A769EA3538510B30E6CB528DE31C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2084-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b42a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3432-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001700000002a18f-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029c51-1252.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2084-1333-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027aa0-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3432-1354-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f000000027a47-1488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0017000000000476-1827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000024f71-2040.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3432 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2084 2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe 3432 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_9014bd56fa5650f6b521213b5b190f5f_amadey_darkgate_elex_glassworm_rhadamanthys_stop.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2084
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.9MB
- SHA256 c2008d71d897c66d4582dd6012fbd0b8fe90216db478b0f287facee0488fde24
- MD5 9014bd56fa5650f6b521213b5b190f5f
- SHA1 ee6c9bdcc99c9e4d94f3df09af85c2b62915c6db
- SHA512 fcdfa55b272abe615e6dfae63d15b9562729373ed585ef61d9ed0a2ad83a976aaa643008fa7072b1cb82ec704c925c78e4441381735ea0a2918a48c13a5e1d9d
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2I:4K5N55sgjOk9WOoK
- TLSH T16EE55B22F66487FAD4738075C9E2A769EA3538510B30E6CB528DE31C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.6MB
- SHA256 197e1d2ef72bf82db7fff4f65f21505a2fde76f5f33b78e079576902814e63fb
- MD5 b99c33c7f363b5d1b2e97eb6e286cc44
- SHA1 91403ec63c732be673618df2a7aa86d65c88dc13
- SHA512 588016e501655eefe8c5f07f444d5b7bba12603ba9001657ee233439bafd31d06e9e85394ad92a39d40e74143e735b7f00ff1d8a6ff0ba4f5beb1a25e49dc0db
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2IRVk0QGTvntC:4K5N55sgjOk9WOoKlHaib
- TLSH T143066B22F6A887F9D4768179C5A29666FA3138110B30E7CB1299E31D1F33BD19D3B721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.4MB
- SHA256 235d4c61b623e5b03e3606dcc16b093113c6f88775a82af98f791d9cadf6076b
- MD5 16d2c6d2d447ad7ff12ee24644dcfc72
- SHA1 1a73e2d7e6aa7e372fba26233ea6da6be7834ef7
- SHA512 6d00fae5174275b0eb6aab322b26499a134248b3ec040a3ab88d6338677a64b94237d0fecb95e98871e1720b47e41cf5c29237d8d45a39e525ecbae8e0afe94d
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2IuTd9CHKyao:4K5N55sgjOk9WOoKVCqo
- TLSH T17CF56B21F6A487F9D4738075C9E2A765EA363C510B30DACB528DA31D1E33BD19937B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 3.0MB
- SHA256 5394967be9f7e9cf600c5ce93c7100dd970796884740b5c42bc8d845e922d3f5
- MD5 101e86c33ca27df2e71261b365910b8a
- SHA1 635cf061b3dd825691daacdaaa28b06ce04a2fbe
- SHA512 e912602be20b435868a562d97a234b35ab0056de331971f38b96b168ce95ec68393684a477c92c8dcc790d3e2e1df22571506209f038954121dc23e13674cbba
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2IcBPVAU:4K5N55sgjOk9WOoK7BPVl
- TLSH T1C7E55B22F66487F6D4738075C9E2A769EA3638510B30E6CB528DE31C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 8ab9107bbc7b5763d58029ec9cb2bee020c4f9d92a7215f842b03695262dc9c5
- MD5 67d14c36dcfa15d72b8a6a36b6729e4b
- SHA1 35f8643e9808e3714f8b45bda1725993d7a579c3
- SHA512 5bc0d8f925078ae59ac708cb7c22ade05efd72d2ee452e0ad249d52f563f7d34254579138ca1e38309a91139f522f21ec970a4d4b94d4ed72e316d3d7beebc69
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2IQPji0Aj:4K5N55sgjOk9WOoKZjo
- TLSH T15CF55B22F66487B6D473C075C5E2A769EA3238510B30D6CB5289E72C5E33BD29937732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 3.0MB
- SHA256 6471610315261244ac3674b164faec057f9324adacc03439cb9f6ab1eda7eeab
- MD5 93c405f1b018c848141f4f71a30dc3d2
- SHA1 69d10741a6bd77c1ac6542b3efdd43090a02005d
- SHA512 2ef4c3011edaf2b41947323f8c1a79935a900447e4626820df6f5c5570d6b877e4b3989f5e41de3bce0b947cb62766d1a2c1e21ecb9c5f203366342410150956
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2Ig:4K5N55sgjOk9WOoKr
- TLSH T199E55A22F66487F6D8728075C9E2A765EA313C510B30E6CB5289F72C5E33BD19937722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 3.1MB
- SHA256 29e5ddcc987854dea0dbcb6e5e5104d4d6167877aad06b4713dfae451c61951a
- MD5 e5bdc6f35ec5d55c0ed0731010b31537
- SHA1 0354fa05c4bdbe7b7cec24958c1824d8c521dcd1
- SHA512 b497b9fd507c059dbb7a3601eddd66d2de22bb307ef3f39bc1a83a314b15d60522568d2281d63dbea313fedc969f2f1b042ec7e2db32d1e7536ce91964b27c0e
- SSDEEP 49152:Be7edCK0DZT88fIfi35DMnCIjtAydIgjdsk9WnOoqJtb2I5qJtb2Iai2WH3:4K5N55sgjOk9WOoKJuX
- TLSH T196E57C22F66487FAD4738075C9E2A769EA3138510B30D6CB528DE31D5E33BD29937722
- MD5 SHA1 SHA512 SSDEEP TLSH