Analysis
- max time kernel
93s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 09:25
Behavioral task
behavioral1
Sample
2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 2.0MB
- Sample260727-ld38bacm21
- SHA256 86db81da4eaabd873477fae092c10f8d31bf06d3bef54bb18b31fe3bae5de083
- MD5 8895ac9672f14bb5f52626a4b92ad349
- SHA1 731ebf2818cca1cd6d2f6723432da6b11a660212
- SHA512 0bd3b61aecd35bb88f5aec6d0a31d3b1c8957a2c200ca20e30bc9ee38ca9b52f9914b05155040f95e2774e5beb61ed156152d1e99aae129d9e1f8ea54b41bbcd
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKD:A3kM8ljgeW4SkZP4sz9Mbo
- TLSH T144A52916F6788362D0BA8075CB96AA55FA333C410BA04ACB53D4F73C1F326D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/1868-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c503-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1868-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3660-106-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-292.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001994b-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019cac-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d09-1272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b6e6-1720.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c503-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-292.dat aspack_v212_v242 behavioral2/files/0x000300000001994b-518.dat aspack_v212_v242 behavioral2/files/0x000b000000019cac-1017.dat aspack_v212_v242 behavioral2/files/0x0003000000019d09-1272.dat aspack_v212_v242 behavioral2/files/0x000300000001b6e6-1720.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3660 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Drops file in Windows directory 31 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1868 2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 3660 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8895ac9672f14bb5f52626a4b92ad349_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1868
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 86db81da4eaabd873477fae092c10f8d31bf06d3bef54bb18b31fe3bae5de083
- MD5 8895ac9672f14bb5f52626a4b92ad349
- SHA1 731ebf2818cca1cd6d2f6723432da6b11a660212
- SHA512 0bd3b61aecd35bb88f5aec6d0a31d3b1c8957a2c200ca20e30bc9ee38ca9b52f9914b05155040f95e2774e5beb61ed156152d1e99aae129d9e1f8ea54b41bbcd
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKD:A3kM8ljgeW4SkZP4sz9Mbo
- TLSH T144A52916F6788362D0BA8075CB96AA55FA333C410BA04ACB53D4F73C1F326D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 2.5MB
- SHA256 b67741f068fae575615638c1047ddb3d10ead83990ec6182b6edf24794bfec71
- MD5 e9621ae3b641c1795776a2d96f51bde0
- SHA1 bbaf602bf7a891534fbeada5331b219e57c4985d
- SHA512 ead8a03a489999266fe943f198b4f57b5e7dbbfb5f726bf8df6dc1d5f4c8336fbb1a763869de90df0dddeb9c6194ac5a854327c2cc07bfe73859079889b95bf1
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKFk96:A3kM8ljgeW4SkZP4sz9Mb9mWD
- TLSH T10BC54B16F6B88362D0BA8075CB969655FA333C410BB08ACB03D4E77C1F376D19A76726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 73f9617e7cd71a6b7d7bcb7219330d63071bd20823db41804df53370509fa50f
- MD5 8de764f792fe0536a910d6c7c1e2577a
- SHA1 b7a350fc12fb2a0c94ff64ed83ef86d086bbe9ce
- SHA512 46de98c433f734d74110c9587e7a2a4a6904dc99bcb14ee44c8111b5a7b1fa7d2efa7a34b77e2b4978d3866d2129f3473a0e73ba78681cefd25002dc8737b531
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwK/0Lu:A3kM8ljgeW4SkZP4sz9MbwPji0Aj
- TLSH T143C52A16F6788322D07BC075CAD6A65AFA3338410B708ACB4385E77C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 2.0MB
- SHA256 2e6d1adfeec5a0755fb395965a90422224c72e452605e55d219af1a114ce62d9
- MD5 d4277f3387d8c23360f9dd7bcf9a5961
- SHA1 827394051563b56bfa311e8bb0ed155460949206
- SHA512 76b258b3475073bf3c1d74329b43eaf486c01dc0b3fc570b232e91d8732379dd789fbeeb9809d195b9d201c463757c24158fd684d6878a5ad41fb8d2dca63220
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKqF:A3kM8ljgeW4SkZP4sz9MbX
- TLSH T1D0A52A16F6788362D0BA8075CB96AA55FA333C410BA04ACB53D4E73C1F336D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 2.0MB
- SHA256 b466c162c8fcfb40fa81f93dfd71e04c40ecef14829d456da348e1a44518c669
- MD5 56e3cb6ec9ffa36f1d4314ed77df8311
- SHA1 3047f269ee7ff2f8f75f50785a6fa0cb12222bda
- SHA512 27bd603d083711e18a4de428c519ac0bfdf71b89fb365f7d807bbf2f830468fce4c666fe55f745d82a0631e9d24de06b845b9ae1194cf1a9104e925bcc938d36
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKfD:A3kM8ljgeW4SkZP4sz9Mbe
- TLSH T19DA52A16F6788362D0BA8075CB96AA55FA333C410BA04ACB53D4E73C1F336D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 2.0MB
- SHA256 de566dff1abfe39b7d04d8252fb8673e66c68a72cdab1c35c62ae844f148cec4
- MD5 709feaa02a2f7a24a4fd9ed0a92e5dde
- SHA1 47e8dc862c5afd97e4dc465e6e8a69a461431385
- SHA512 a21a385a28832c96af85e8abe002d2bd16133931968dc3314815839c01c616c6f6a478b87ce66c14a7dc6d4b48817245515ef4d15cbcefedc461171f1062517e
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKCwE:A3kM8ljgeW4SkZP4sz9Mb1
- TLSH T1F3A52916F6788262D0BA8075CB96AA55FA333C410BA04ACB53D4F73C1F336D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.1MB
- SHA256 83f4dd6850dc02506233cc18d8962a2382e2a798c39f368ba14446359a5ca072
- MD5 4394b195983d49c49164cd55bec4610f
- SHA1 1292237a45ee55c951ee0608bf02574fb57d0361
- SHA512 7f8483e8f8baa531ffb7a9332b3c9f965a2717708250b41f9b0ee6e431905cd91c765116323da5cf6a6d7a3ad95bba4b1466658d2227906e902612f9cadb08b5
- SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEg6TajoHZe0p4Ek4niOkl/A04szE87JKTvmwKbF:A3kM8ljgeW4SkZP4sz9MbA
- TLSH T164A53912F6B88322D1BA8075CB96AB55F9333C410BA04ADB53D4F73C1F326D19AB5726
- MD5 SHA1 SHA512 SSDEEP TLSH