1f7e790e9a90b5a12a65b818e1e08207b9a282b30217ca175b9af7060c6cf501

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
Size 4.1MB
Sample260721-ss3nnaw1ex
SHA256 1f7e790e9a90b5a12a65b818e1e08207b9a282b30217ca175b9af7060c6cf501
MD5 4e1e65417aa0c17a9ff58154c98d323d
SHA1 d9117d5f9f02f4806c59c3048eaaa0f44609cc2c
SHA512 c4c5b010f257105756a3fcb100764db9b3ce5679f00202bde1b76b6363ba2a029803caf2dafc5b35217c4c47eb544a08d856a3d99a2dfd1b01eec7bf994e71fb
SSDEEP 49152:HHIXkCM84pkO7HhpLtTToonbXaIHy5rCbRquA/m2yL5zbfFiV+XenmE3/zGqatga:HoULf1HhpL/nbXaP0oq2Vjnmfd
TLSH
T170167D1677A881B4D1F7C6748AA28652F7727C114F31A7EF1295721E1E33BE09B3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3732	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.viv

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\nmhproxy.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\vlc-cache-gen.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jdb.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jabswitch.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Mozilla Firefox\updater.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\rmid.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\native2ascii.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jjs.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ktab.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\kinit.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\servertool.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\javap.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\pack200.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\keytool.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\schemagen.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\java.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\tnameserv.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\WORDICON.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\7-Zip\7zG.exe	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jcmd.viv	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 3732	3376	2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.viv
  C:\Users\Admin\AppData\Local\Temp\2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.viv
  2⤵
  - Executes dropped EXE
  PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 6.3MB
SHA256 baadbee2430c2242a660def5d43eecb20f75ec0bd8cd35f2240efa49169f4abc
MD5 c458a0b87bee12602e19269b6ef9e38f
SHA1 7f1be1374345ecf7c9a809949e564079b6316b8e
SHA512 cfc8e82a36b45d0e3c05911c7a66de9a8797529236a0c38cbc0250aa9a07d7b8097ff4a7448c8c67706850560533cadd8efc720d15040cdf19a827dfe5d9a65e
SSDEEP 98304:HoULf1HhpL/nbXaP0oq2Vjnmfloq2Vjnmh:hTXpLDXzGniGnI
TLSH
T166667D0A76A881B4D1F6C7788AA2C653F7727C154F30A7EF4255661E1E33BD09E3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.viv

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_4e1e65417aa0c17a9ff58154c98d323d_amadey_cobalt-strike_darkgate_elex_glassworm_hijackloade.viv
Size 254KB
SHA256 2e0c3f79294b0a9e92b289232050793a40dc038b0bb98ba3c1339eb2aea72cb2
MD5 314799778efc1eed3c8709662c1d313a
SHA1 cb1f55d3bd370a84c98bb67b30fde70275dddc5e
SHA512 aa18dac2d6ed3ad04e54ec8ec9f7df47baa5ed9e394afaac19670d3ac9b915d29c374452d2bed8fbadfaefbefc50f749682756aec3ee9c52af5319ee049c578a
SSDEEP 6144:aofOiYlrOF7ojDuUlMtq10Q8m7NNqM9N+hN1UFpfNS5iXjD56Gpovgp2H32nq546:a+BeDuUlEqatglsLbP
TLSH
T14F44D786BB45D6B3D41A0232485B57D32BB1B8161F16A39B2398737D9F333C0B7326A5
MD5 SHA1 SHA512 SSDEEP TLSH