Analysis
- max time kernel
113s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/05/2026, 17:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 5.6MB
- Sample260529-vjvb2acv3r
- SHA256 9211b9c836250633d83336e720609321b8ed84c5813b767d72ae5f0deba0fe39
- MD5 d921d6329923ec7153f1d354daa39f4a
- SHA1 92e173da2f024740f5168f093f00976897c874e4
- SHA512 9e49bd5d3bb60dcb05c670ddc7cad8049a18326255122bbb77b2eb1093877642bd9e6e485232d42d08924559d45de9e1fbcbdd59d987547aac935f526de73ef9
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56ra:egjOk9WOXV2VMG9r3JrLjo
- TLSH T16C46E712AD6C4A61D07FBC748991D7A9E5323C414F21ABC71EC1BE5DAE726C0B93D322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/5036-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002454d-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3832-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024376-123.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021a3b-1021.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216fc-1244.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5036-1367-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3832-1404-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c000000016910-1861.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3832 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5036 2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 3832 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_d921d6329923ec7153f1d354daa39f4a_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5036
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.6MB
- SHA256 9211b9c836250633d83336e720609321b8ed84c5813b767d72ae5f0deba0fe39
- MD5 d921d6329923ec7153f1d354daa39f4a
- SHA1 92e173da2f024740f5168f093f00976897c874e4
- SHA512 9e49bd5d3bb60dcb05c670ddc7cad8049a18326255122bbb77b2eb1093877642bd9e6e485232d42d08924559d45de9e1fbcbdd59d987547aac935f526de73ef9
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56ra:egjOk9WOXV2VMG9r3JrLjo
- TLSH T16C46E712AD6C4A61D07FBC748991D7A9E5323C414F21ABC71EC1BE5DAE726C0B93D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 5.7MB
- SHA256 8b48c86df4c470541da2b88dbe5ea6afa135acb1c2163332be7f4d3bd36e99e3
- MD5 be1f2d869bc031bc1f46c5d67c13d028
- SHA1 cc17434bab7c4b89afdb3fc341f18d61347bdfa3
- SHA512 477ee99142495c9773221f1336b11033063562c1716355029e9036249bf559997f8308b1c8913904972936275a5bc687d4f668992cc4b44fe8aff545f7c92b65
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56rr:egjOk9WOXV2VMG9r3JrLjoSBPVl
- TLSH T1F856F812AD6C4A61D07FBC748991D7A9E5323C414F21ABC71EC1BE5DAE726C0B93D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.1MB
- SHA256 403d90c7b8b54127e65e88a1f6ec1cb59a87ce276ca1bb36ba92f5d9c5b8eb88
- MD5 58eb7b918fbb449686326ae1c6cedeb0
- SHA1 5e2994553b363b04e72dbfbd80ae05e3f305ccb4
- SHA512 16b43b7d1d15a36e641610e3be6e24e2e5d90325dd95ed2cf7db1ad376823428761303ad4013fa9869b8ce40291404bffbf6db5d5467df53d996d3944e5e60da
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56ry:egjOk9WOXV2VMG9r3JrLjo0jo
- TLSH T19156F712AD6C4A61D07FBC748991D799E5323C414F21ABC70EC1BE5DAE726C1B93E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 5.7MB
- SHA256 18e748997143179e7a00f149247143c4932a85947d971647fc32b0f028e82e95
- MD5 7b9da7c546a363a054a770f0bc3d8b9d
- SHA1 4dfd6a2b6dbe78c4250c983a19dd2ac6eb74c02b
- SHA512 5e829fc61649e4cef7dc1f99cb3ade25b57ebdce3f57b6cb3d6824a51d34be912917be8c41bbddeec58d4f3c0cf0cff7ff6b8746d1e4b03612d618c19071e15b
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56rM:egjOk9WOXV2VMG9r3JrLjoT
- TLSH T11C56E712AD6C4A61D06FBC748991D799A5323C414F21ABC71EC1FE6DAF726C0B93D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 5.7MB
- SHA256 c868456ef43c7ec9127176b2df7e9251564f86a96647f57d009b9d1dff6862ce
- MD5 84abd5ae5dd7492a0746dba8c426ad2b
- SHA1 a2207a467a563a187828e31384e7d394e5f908c4
- SHA512 31c363f0292332624d96c37895b92e851f6f29b45a7b5519c3db1a6c1b8c7bb6b8131e890f8735cb0cc0858beb1e34dd79081bad493849e66c1a7fcb15fca452
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56rs:egjOk9WOXV2VMG9r3JrLjoX
- TLSH T18656E712AD6C4A61D07FBC748991D7A9E5323C414F21ABC71EC1BE5DAE726C0B93D322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 6.1MB
- SHA256 19768798f0429181211359323c75eb32c7e5791d73680d9ddf17c172eb8b0435
- MD5 f4c643b631c0d842af8a12cc7d07e809
- SHA1 343d11048bf919e7f8755a81cb2fa1ef6a1000c4
- SHA512 6e77499afdfdd55c9dd1ce721a833aa8e2643391007432e6d05c689f17a07b24c28006085a8402da0c9f2518a3623efb953d81a7418fdeb8c72649ca1a7b0d7d
- SSDEEP 49152:BWvBjLfUHIgjdsk9WnOjbtL2tLM2RAR5FeA6wcqJtb2IerGH56rptqJtb2Ij56rV:egjOk9WOXV2VMG9r3JrLjo8i6
- TLSH T1FC56E713AE5C4A71E06FBC748991D3A9A5323C014F625BC71DC9BE5DAE726C078BD322
- MD5 SHA1 SHA512 SSDEEP TLSH