Analysis
- max time kernel
104s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 12:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
- Size 6.3MB
- Sample260711-ptvsnact8y
- SHA256 460064796a8c85ec8b43da6f4e9f36685afce4da3309a0d6ad713d388a59da89
- MD5 afd1b1b67ad2e22254a95de08764130a
- SHA1 0e6c6f88a9efa4205f82fe3cb88b8f3e00cd7487
- SHA512 3dcf5f24a2f432432e9b1601f0464cda105fec38811ab0bd1e63962a0ee5c957c6d4015b9622f955a3b8761d49289440a8ecaf30d08b92616ebfa86f136f230d
- SSDEEP 98304:b2A+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tj:bSmAYM
- TLSH T19666840066AA4531CC2D8E304A29A9B8F1117D4FBD6FBE1B2D817DDEFAB32C5551A133
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3688 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2792 2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe 3688 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_afd1b1b67ad2e22254a95de08764130a_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2792
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3688
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 6.3MB
- SHA256 460064796a8c85ec8b43da6f4e9f36685afce4da3309a0d6ad713d388a59da89
- MD5 afd1b1b67ad2e22254a95de08764130a
- SHA1 0e6c6f88a9efa4205f82fe3cb88b8f3e00cd7487
- SHA512 3dcf5f24a2f432432e9b1601f0464cda105fec38811ab0bd1e63962a0ee5c957c6d4015b9622f955a3b8761d49289440a8ecaf30d08b92616ebfa86f136f230d
- SSDEEP 98304:b2A+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tj:bSmAYM
- TLSH T19666840066AA4531CC2D8E304A29A9B8F1117D4FBD6FBE1B2D817DDEFAB32C5551A133
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.8MB
- SHA256 ead4f7be04d53ff994ed5e9ede31ecd802e9696da6cdc6e1db832992d4b72fbb
- MD5 c9a3b232015e604f8199c8516260e3b6
- SHA1 a0c4ec54ca3232e30780224662777dc533d3f516
- SHA512 88dca70fce6aa844f2aa90303642d460a8a7f5cdcac32ddd6173d593abeb5b3cc3d65dac5e7c0272e15a760fba22d9fe6441713135792c8e07492f59f0ac6fbf
- SSDEEP 98304:b2A+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tc:bSmAYko
- TLSH T15176C70066A94531CC2D8E304A65E9B8F5213C4FBD6FBE4B2D817D9EFAB32C5551A233
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 6.3MB
- SHA256 3aa9ca366308707436aea44ecb2571df6a8ccbd7e512f2fdf3e01dfa2639db12
- MD5 3297f8e23a22df81eb609ac2020e821c
- SHA1 038336495db100e87d0a66afadb6776757c77b1b
- SHA512 596b224d5d9633bd5acfe692bbbc6c3bf593111fc8c01dec57d49b1fe86769e08e3ede43ab69cdedc8f7910d1dcd48c849583470f4b5d1340beddf6227371485
- SSDEEP 98304:b2A+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tI:bSmAYR
- TLSH T1AE66840066AA4531CC2D8E304A25A9B8F1217D4FBD6FBE1B2D817DDEFAB32C5551A133
- MD5 SHA1 SHA512 SSDEEP TLSH