Analysis
- max time kernel
120s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 04:34
Behavioral task
behavioral1
Sample
2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
- Size 3.8MB
- Sample260718-e7lf2abx3y
- SHA256 32ec90db4584ae41a3aab83438a1f26fe9e3d1cf6cee3a0fc5292ad7a7691681
- MD5 23d49f23559e3e91bc1bb61cecd295c3
- SHA1 f2bd290f6547cf58e7ef853aa682ea201d362cb5
- SHA512 d757c1ffb50cfc95be11f1f435d186085b45b4a0512f22389449077ae978cfee4e5e1c6a3fe2611821633ed24361d2677db6a85e4681c79d8e54dea979242e48
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9Mb:A3k03kHRnfkZc41lkNPFfkZc
- TLSH T135062B16F6B88332E0B3C075C5E6AA5DFA3134459B318DCB02459BAC2F67BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/3524-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c43b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3524-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2432-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d97-1258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001892d-1480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b7f3-1642.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c43b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019d97-1258.dat aspack_v212_v242 behavioral2/files/0x000a00000001892d-1480.dat aspack_v212_v242 behavioral2/files/0x000400000001b7f3-1642.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2432 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3524 2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe 2432 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_23d49f23559e3e91bc1bb61cecd295c3_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3524
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.8MB
- SHA256 32ec90db4584ae41a3aab83438a1f26fe9e3d1cf6cee3a0fc5292ad7a7691681
- MD5 23d49f23559e3e91bc1bb61cecd295c3
- SHA1 f2bd290f6547cf58e7ef853aa682ea201d362cb5
- SHA512 d757c1ffb50cfc95be11f1f435d186085b45b4a0512f22389449077ae978cfee4e5e1c6a3fe2611821633ed24361d2677db6a85e4681c79d8e54dea979242e48
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9Mb:A3k03kHRnfkZc41lkNPFfkZc
- TLSH T135062B16F6B88332E0B3C075C5E6AA5DFA3134459B318DCB02459BAC2F67BD18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.0MB
- SHA256 38f7b64cac9311296402ba088b4fd08972170a3c72d5360e6cdb83281dd8ee03
- MD5 eadb9ec2875862e76388fef059dd887c
- SHA1 b7f48e1a0b0e80b1c53e5591fd5ecceef6203157
- SHA512 b42eaf359e946d57a442d20d8839a728b7dd6ffa0f0dd4a0002bb530bbeae5edd918ff083e0af0b0736fcacbc5b1cefd4d892f997bd2397aacae16372fe3b61f
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9Mb/+t:A3k03kHRnfkZc41lkNPFfkZcC
- TLSH T1AF163A16F6B88332E0B3C075C5E6AA5EF93234419B318DCB13459BAC2F676D18A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$
- Size 4.3MB
- SHA256 c8403320d6911defd1faf04c110c82f71cf3b348f78423b249f9ea1f2b4dd0c3
- MD5 26fc66ad458b688f0a71186e2108e2bc
- SHA1 33290fbc1ec2e4738d9f7b5c5ca1c06e22db7a7d
- SHA512 245735c731e6e90dfe17669262c6f8f354e965e8f6d117fa8b6bdbe2c70fce2a6ab34ae461bd1b1acb93cf4e3fd30277ae8ee5e92a157f1e26884df3aa08fc59
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9MbomWD:A3k03kHRnfkZc41lkNPFfkZcomW
- TLSH T164263B16F6B88332E0B3C075C5E6A65EFA3234459B318DCB02459BAC2F67BD18A35735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.3MB
- SHA256 b007617790c6e0b6f216a2e75c6b481b72ac9b33dcbc3e2dfce72bfbcf36455d
- MD5 05e115b51438b805c32138b5e1541461
- SHA1 ebb192ad038530f8b9b2256142f14e3fcde1156e
- SHA512 aa67b74bc6986ffa0c04173971cc855a92b83d4a90937c1673abb76a0807d86c57c3aaf9563250201aa7a995a21b487aa82e8d3a685e18110694b0f1e561c003
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRnfkZc41lkNPFfkZcRjo
- TLSH T1D7262A16F6B88332E0B3C075C5E6A65EFA3234459B318DCB02459BAC2F67BD18A35735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 3.9MB
- SHA256 00cb75907d5dc23d7c4bafd9f24165c1b723c24f1bd31b547948e0f81d432564
- MD5 b0e835cfb0546bbbb24b9639d1d0bbd1
- SHA1 0cb926949cb6dad3703748d7a4f94431c49f42e5
- SHA512 0a6e2f14b1130ddfb818ee90791a3af47aa3254ac5668290a83ff486e7c4f6e1f4b5bb94ac4b0bb2af3dffda721b90247064d3174ac210217d2fee7637aac323
- SSDEEP 49152:A3k03kHRJteW4SkZP4sz9Mb41lkWu0yPqJtb2IEeW4SkZP4sz9Mbj:A3k03kHRnfkZc41lkNPFfkZcj
- TLSH T188161A16F6B88332E0B3C075C9E6AA5DF93138419B318DCB0245ABAC6F776D18A35735
- MD5 SHA1 SHA512 SSDEEP TLSH