9425acfa19636943ab32f5f394ed5258be96ac9656fef1359020d1b9fc0f1861

Analysis

max time kernel
98s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 3.2MB
Sample260717-txecasfv2k
SHA256 9425acfa19636943ab32f5f394ed5258be96ac9656fef1359020d1b9fc0f1861
MD5 e80c1c32bece5f43713be05b203999f6
SHA1 68f858f48b711fde446ba6041d0ef1dd211eca71
SHA512 cf480f0338887bdb2082b2897546db89ec80472a5692a88f1b739ce598a548a7875677f71af5823ad088e8726e3c5c6bf18881cc6bb19aa135379b755ccc16bc
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r:A3k03kHRnfkZc41lkNPJr
TLSH
T1C9F51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5296-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5296-87-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2008-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019994-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb33-534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb3-1266.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019994-532.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb33-534.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb3-1266.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2008	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5296	2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
2008	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e80c1c32bece5f43713be05b203999f6_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5296

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.2MB
SHA256 9425acfa19636943ab32f5f394ed5258be96ac9656fef1359020d1b9fc0f1861
MD5 e80c1c32bece5f43713be05b203999f6
SHA1 68f858f48b711fde446ba6041d0ef1dd211eca71
SHA512 cf480f0338887bdb2082b2897546db89ec80472a5692a88f1b739ce598a548a7875677f71af5823ad088e8726e3c5c6bf18881cc6bb19aa135379b755ccc16bc
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r:A3k03kHRnfkZc41lkNPJr
TLSH
T1C9F51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.7MB
SHA256 75d9ee718a31bcb571cd461a5685f966354634e4921565550cc64eb1cf56c04f
MD5 5f0282b74dcc83da4f020f8afbd6c0ef
SHA1 b016dab62ba6ad5ac078b6490c8b1eff2ab1566b
SHA512 9401589f6066dfb548f846836ca63f71adeca56744126bcb62e9893b8f903b36ca853329104ffd2d9cc6f48a9fc19739fd96435b06768f2327c1bc607adf3480
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r0Pji0Aj:A3k03kHRnfkZc41lkNPJrSjo
TLSH
T15A062A16F6B84732E077C175C5E2A65EEA3238419F318ECB02459BAC7F63AD18935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 3.2MB
SHA256 c9e109717f0c061699c38b0ed2074c562b466612528eb5e019159227b521ab51
MD5 27d353e9584b1044df7d13455b507d59
SHA1 2242e27a8b5f31116f46cd1d7a1a241fccc1f4a5
SHA512 2ec24bb43e26e3355e9fa3e94a7113681dc0e6351507724f983c9d9e9d5473f7789a7fd91fb68e52c912aa03d4510fb59752c4dca45fb61c163c94c3afe329a2
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rQ:A3k03kHRnfkZc41lkNPJrQ
TLSH
T144F51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 3.2MB
SHA256 196c8bd00de9db09f1726025594facd2c3d084eb5e3fbee723f1e798caf410e6
MD5 f7302c02bc27aad64c2ef0f836316ebf
SHA1 412fa554d2432eae144b51949f94206b1f101629
SHA512 57017552527d497844f9f7d640bc306a946b836c79f9b3db08e185ae16f44f1504b42da9985c07159f552b11ad1190f39d4c01b3c2f3cd819298caa8318ad5ea
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56r2:A3k03kHRnfkZc41lkNPJr2
TLSH
T10CF51A16B6B84732E077C174C5E2A65DEA323C419F328ECB12459E9C7FA3AD18935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe$

Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
Size 3.3MB
SHA256 3d5599b4a7454e7918e9d83a3ebffc514587ad3d952f82f78d9959978aa0627a
MD5 2ba123195e19d4ea0116700ba64b3ad3
SHA1 67ae7f3af2d85bcb4ae647000f630d689a3f2791
SHA512 ec87f3b91c518a7cce2a0736d2cade88c7c6fb4ecfa7a62e1edd6580d2c913db15b5b81e0a94b16c8e90bc519fcf2e704bd7b21bcf5e9e821d2558e59bd3424f
SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2Ij56rc:A3k03kHRnfkZc41lkNPJrc
TLSH
T10FF51911B6B84732E0B78174C9A2A65DE9323C419F328ECB1244AF9D7FB36D19935732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2008-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5296-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5296-87-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads