4eb76d6d094b7e8aaddba53bc86a59579b9bea080af46210f7a8871f7216ea00

Analysis

max time kernel
141s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 20:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Size 5.0MB
Sample260629-yyq5psev2x
SHA256 4eb76d6d094b7e8aaddba53bc86a59579b9bea080af46210f7a8871f7216ea00
MD5 ba31f94e0d3261ae06d5c1fe2aa083da
SHA1 af026f9db1204c64691b3e44e06cd0be0521b8a6
SHA512 25846a54f1a88ce6e4e46326490e7f223cdad286c5ebb25d90aee196229ef7653ddeb586a7e312f25511db3f7c5eb51df48f6711f4aaabd16dfed727e4069ff2
SSDEEP 98304:v+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWH:WmAE9695ta1gT6
TLSH
T174363811E2E44862D0BF5535DBA6A616BA33BC550BA082CF12D4F67D1F337C0A9B6723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/5932-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001500000001c522-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2ee-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3812-16-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5932-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000019dc5-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0017000000008f20-1376.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001500000001c522-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2ee-11.dat	aspack_v212_v242
behavioral2/files/0x000c000000019dc5-1214.dat	aspack_v212_v242
behavioral2/files/0x0017000000008f20-1376.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3812	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5932	2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
3812	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_ba31f94e0d3261ae06d5c1fe2aa083da_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 5.0MB
SHA256 4eb76d6d094b7e8aaddba53bc86a59579b9bea080af46210f7a8871f7216ea00
MD5 ba31f94e0d3261ae06d5c1fe2aa083da
SHA1 af026f9db1204c64691b3e44e06cd0be0521b8a6
SHA512 25846a54f1a88ce6e4e46326490e7f223cdad286c5ebb25d90aee196229ef7653ddeb586a7e312f25511db3f7c5eb51df48f6711f4aaabd16dfed727e4069ff2
SSDEEP 98304:v+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWH:WmAE9695ta1gT6
TLSH
T174363811E2E44862D0BF5535DBA6A616BA33BC550BA082CF12D4F67D1F337C0A9B6723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
Size 5.4MB
SHA256 a5c93ffae0722b5069b43a135704e1967aa8c49a881c538f2b0c2c31fb220415
MD5 dfc1e091377e68b938bc70cc6494786e
SHA1 ed7cc756078b3d34c4c7addb8f2f0b795205d339
SHA512 d7674f220e5de6bc0ee610514178d7d237034e6357c271fdff5a74490b72bcf40a6aa892c70320a6880b34e205439dfb431e7cbfec963cafa129c55ced18e10b
SSDEEP 98304:v+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWN:WmAE9695ta1gTQ
TLSH
T1E6464911F6E444A2E0BF5535DBA6A616BA337C550BA082CB12D0F67D1F337C0A9B6723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 5.5MB
SHA256 c310650914af65360b41f4c219d20ea002e705bcc2f94dbdfa67a2c90771fe88
MD5 3220474780f0be6adbc5e388654487c0
SHA1 b22bc174a04f955d46946fa5244ac46f19ee2274
SHA512 2dde4522831cf7551bbae53ddb871d01a2199f88b9068684a886000f5ffdff70df26f5c80a0296353f183c3e5c34cb23a29a90bb8169d76635f6ed54cda86648
SSDEEP 98304:v+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWw:WmAE9695ta1gTSo
TLSH
T186464811F2E48562D0BF8575CBA2A616BA337C510BA086CB12D4F67D1F337D09AB6723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pptico.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
Size 5.4MB
SHA256 bf8342e162151274d5cccda198fca0ded151b7be5ea5449203c6eb8861df5642
MD5 9762c2fc5242686ccf12194cd703a7bd
SHA1 9a3000f77e6986913d2e77b12a723e1a2bc5be66
SHA512 7ed828ad966e2ecf568149c0fe3ddc033557dcb945a6a999a4a9dd7b0296aa7f46a969ae442bb31aa4f5d3c87c9c82a9727464d59c516b867b447bbe0a2997f2
SSDEEP 98304:v+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPW9:WmAE9695ta1gTH6
TLSH
T1EC462712E7A48C72E0AE4535DBA29625B6337D150BE282CB12D9F67D1F323C099F5723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3812-16-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5932-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5932-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads