Analysis
- max time kernel
74s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/07/2026, 16:25
Behavioral task
behavioral1
Sample
2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.2MB
- Sample260717-txecasfv2k
- SHA256 9425acfa19636943ab32f5f394ed5258be96ac9656fef1359020d1b9fc0f1861
- MD5 e80c1c32bece5f43713be05b203999f6
- SHA1 68f858f48b711fde446ba6041d0ef1dd211eca71
- SHA512 cf480f0338887bdb2082b2897546db89ec80472a5692a88f1b739ce598a548a7875677f71af5823ad088e8726e3c5c6bf18881cc6bb19aa135379b755ccc16bc
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r:A3k03kHRnfkZc41lkNPJr
- TLSH T1C9F51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024675-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/844-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4636-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/844-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021696-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022bf7-1696.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000022bf6-1756.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000000745-2060.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024675-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0004000000021696-748.dat aspack_v212_v242 behavioral1/files/0x0002000000022bf7-1696.dat aspack_v212_v242 behavioral1/files/0x0006000000022bf6-1756.dat aspack_v212_v242 behavioral1/files/0x0008000000000745-2060.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 844 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4636 2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 844 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 9425acfa19636943ab32f5f394ed5258be96ac9656fef1359020d1b9fc0f1861
- MD5 e80c1c32bece5f43713be05b203999f6
- SHA1 68f858f48b711fde446ba6041d0ef1dd211eca71
- SHA512 cf480f0338887bdb2082b2897546db89ec80472a5692a88f1b739ce598a548a7875677f71af5823ad088e8726e3c5c6bf18881cc6bb19aa135379b755ccc16bc
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r:A3k03kHRnfkZc41lkNPJr
- TLSH T1C9F51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$
- Size 3.3MB
- SHA256 131187dcb20a16fac73c96f73b0ee3a59e70e3f898c2ac6a6ceea448b8a3db16
- MD5 e4ec547eeb462e708fbd3462a64b84bb
- SHA1 b4066988f23ebb554dad5fabe24fc6aac1a51287
- SHA512 2d58a7afdf2200cee3352a0de776810428299dec6038d36bff3c19b25bfdbce4be1ab1699ddc43822340064e5de9236f2371035a72a2042a3dde667ce760efa7
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rWI:A3k03kHRnfkZc41lkNPJrWI
- TLSH T1B4F52A12B6B84772E077C174C5E2A65DFA3238419F328ECB12459E9C7FA3AD18935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 3.3MB
- SHA256 e1de6b82041c60b0d9002441fa377ddef6b2c04e07046d55d69d2d151d1794ac
- MD5 3b79daa4e16cc9f1d4aca5db1ab4fe2e
- SHA1 e37e83e89cbbbc5ff3bf8971c49f27c1fabe46ad
- SHA512 a459fdadf1d86faf85fe9f167eb063d5f0310c7c0b1f7acea30e3f4ecef4867a21a16061aba0f968f4f4875f2710adaacec5fed2a98fbcc8382a13efe31c654d
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rSw:A3k03kHRnfkZc41lkNPJrP
- TLSH T134F52A12B6B84772E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 75d9ee718a31bcb571cd461a5685f966354634e4921565550cc64eb1cf56c04f
- MD5 5f0282b74dcc83da4f020f8afbd6c0ef
- SHA1 b016dab62ba6ad5ac078b6490c8b1eff2ab1566b
- SHA512 9401589f6066dfb548f846836ca63f71adeca56744126bcb62e9893b8f903b36ca853329104ffd2d9cc6f48a9fc19739fd96435b06768f2327c1bc607adf3480
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r0Pji0Aj:A3k03kHRnfkZc41lkNPJrSjo
- TLSH T15A062A16F6B84732E077C175C5E2A65EEA3238419F318ECB02459BAC7F63AD18935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.7MB
- SHA256 f067685834894a43a4199542090810c8e43f42e3a4ee6426a63c3d8a551ecbb7
- MD5 67a5a0f7e13845ddbe7715e3f3fadca1
- SHA1 8b1304750350a3d4837b58d6073bfaf8f02d742c
- SHA512 f06c257dca8f68ed1aac435ebe5419e9ec1231877344adc090cafe60fb04735fcc17aa9b389890c8146a8d022d13e000e113cdeeb2a7066e15b4cfcc9cef56f5
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rIUOlk09:A3k03kHRnfkZc41lkNPJri9
- TLSH T11F062A16F6B84772E0B7C174C5E29659EA323C418F328ECB12449BAD3F636D19A35732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.4MB
- SHA256 88d563ca0021969fce25b983af86ec650ca0cc53b3fa937dae030b25aa04bcdd
- MD5 47764e562ee6851002498862f1209e66
- SHA1 562c1e525f8b54aaf35e693c6fcf09c0240cf016
- SHA512 a323b04f95112c29b9fde5c6a9e2e5ec924b0ced0a0540f5350c09d18be02031a4516c936f7e0d4a5cc8576e9b4571135232be5537c3429158c2b408797881d1
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rOi2WH3:A3k03kHRnfkZc41lkNPJrOuX
- TLSH T1F1F52A12B6B84732E0778175C9E2A65DEA323C419F328ECB13449E9D7FA36D18935732
- MD5 SHA1 SHA512 SSDEEP TLSH