421fbf28ff554f2179332d18c6ee0f11f508138700035e059b945b43ad5bb7bd

Analysis

max time kernel
102s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 2.0MB
Sample260628-2a8xdsft7t
SHA256 421fbf28ff554f2179332d18c6ee0f11f508138700035e059b945b43ad5bb7bd
MD5 5b6267ec8878e5272322a4ca72160ef7
SHA1 cabfd930a52afb22e382f904e24ab097ce2e8ba5
SHA512 d24fff376d2eaae439fc35c431624154429854678e4930637f5ff2c780a2cec8543c09cb0cd94edcd040c8f1e5cc170c440b59ef81bd5225bb8d9f9c740b9aba
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCV:A3kMPljIqJtb2IdqJtb2I
TLSH
T1F9A54B26F6748371D077C0B9C5D2AA5AEE3134425B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/5972-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c68c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5972-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1604-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001996a-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00200000000198e1-516.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019e07-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac6b-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019ce3-1258.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 7 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c68c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001996a-514.dat	aspack_v212_v242
behavioral2/files/0x00200000000198e1-516.dat	aspack_v212_v242
behavioral2/files/0x0003000000019e07-1181.dat	aspack_v212_v242
behavioral2/files/0x000300000001ac6b-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019ce3-1258.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1604	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5972	2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
1604	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b6267ec8878e5272322a4ca72160ef7_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5972

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.0MB
SHA256 421fbf28ff554f2179332d18c6ee0f11f508138700035e059b945b43ad5bb7bd
MD5 5b6267ec8878e5272322a4ca72160ef7
SHA1 cabfd930a52afb22e382f904e24ab097ce2e8ba5
SHA512 d24fff376d2eaae439fc35c431624154429854678e4930637f5ff2c780a2cec8543c09cb0cd94edcd040c8f1e5cc170c440b59ef81bd5225bb8d9f9c740b9aba
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCV:A3kMPljIqJtb2IdqJtb2I
TLSH
T1F9A54B26F6748371D077C0B9C5D2AA5AEE3134425B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.6MB
SHA256 7b7516274bca298566b59569329a3d6888dd6afe31678296da3570ea0c8f445b
MD5 9709639812585563c8f7e27f9e4294d8
SHA1 2060925706bb0904e2909ebf489c529c5ecd9445
SHA512 aeab66731e6f725dfa249a58d844acedecc7b938e66ee7000035cb9bdf7527caf78f3ad7fec72c0c29ed7ba54f175b0b8b8754b0babd3ed2d4bab30cd2c93e14
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCh:A3kMPljIqJtb2IdqJtb2IQPji0Aj
TLSH
T182C53B26F6748375D073C0B9C5D2A69AEE3134425B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 2.1MB
SHA256 5c4bb1d8458489e8c4ee254b59cb12115370c0d4e5137bc4ab5ced08234d02c4
MD5 807cc78f74eeb1a48b6fc3ac5ba50604
SHA1 6bb3db872ffd52d8018ce84f4e29766ea62f9a14
SHA512 3289c9afb376db492b0ff16cb618c293f6d7d8f3c8c2edafbf79d82f58e428911ea9e0cdc85ccf18dd61ab615548b84d956042fbcc0eb3051f9e4528efb859b4
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCV:A3kMPljIqJtb2IdqJtb2I+
TLSH
T182A54B26F6748371D077C0B9C5D2AA5AEE3134425B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe$

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$
Size 2.2MB
SHA256 9cc434d5eb75d8c0a3c4f3cce8ded694b464a8f0222174e17f041ebb9eeadd80
MD5 21bf9eca4da90f4cdacb0894a74e7476
SHA1 4f07fba1664922b225151d7f728a9a67f20b9fc6
SHA512 7d172e708b5b141a5447249f71fe6226305185cb246320945b60dd0514c894420532376801dfb91bdcc7d8fd46f0eb1d7bce94060a92236f6e3df804c6d0a346
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHC6:A3kMPljIqJtb2IdqJtb2Ix
TLSH
T1BFB55B22F6B48371D073C479C5E2965AEA3238425B308ACB5389976D2F377D1DA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
Size 2.1MB
SHA256 8c71c392ee1ed0a26845f80fe12b5bf396578cbd2c44f11a440bfab0076ce764
MD5 42558ffbba7a604b18b46d26526366bf
SHA1 301701dddabedf3b3508c658738e4ba379328270
SHA512 cc65a18eb626cd657328267fee13f4845dde2434b6567bf95155004c2b0918acf32ac06d83c797b5f9ef75c75eef7ede285951fe44dd4779d6bd3f5070faabaa
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCZ:A3kMPljIqJtb2IdqJtb2If+
TLSH
T161A54B26F6748371D077C0B5C5D2AA5AEE3234425B308ACB5389D76C2F277D29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$
Size 2.8MB
SHA256 a3b4db1b63c62c02b291721ee898ed7aa8d482ed904384c4008438faa71e2027
MD5 92ec7e50214dedb98b249273649d60fb
SHA1 6f848060a16c8dc7faec2eaa49a25c3091353bf1
SHA512 61fd7f8e0bea8bb0ae743bdaf4fea3a27a83ef36fcc35ce956e563827e1ff0d0c8c8b5f29f59839d01f9a0f2966f979a078cb6c7f13576aad4b68fffe652ee29
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCY:A3kMPljIqJtb2IdqJtb2IP
TLSH
T18DD52821F6688221DC3E8D75C592A676F9313C8F7F2CB5CB1E45B2292E336D19536322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe$

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
Size 2.1MB
SHA256 0762779e891ef72b8150abc3ccf943cfa95af2a662dbdc7d895c6a7c0b0fc1fb
MD5 5c5a77434e0dd32c9783575588f6cda0
SHA1 a173ab1d4da7ddb304627426fe6e6980d3848f24
SHA512 ad3c9304cfd21839e0a5155037147076121cbefda1e0acdc36c3219c02acc544290bcded037feeb4af0d5f715320df59cbef0f4ec458a73c92b873534277ced2
SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6joWThYTqMi8CtBd2QHCHmTBW5bYTqMi8CtBd2QHCv:A3kMPljIqJtb2IdqJtb2Ig
TLSH
T141A54B21F6B48371D077C075C9D29B5AEA313C825B308ACB5389A76D2E377D19A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1604-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5972-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5972-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads