Analysis
- max time kernel
105s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 19:01
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe
- Size 4.8MB
- Sample260731-xpdmkseq4z
- SHA256 32f21c00fba848f071c0b23c92d255097ab841c3065ab249e81fa1dda3a67f18
- MD5 21956e37e9d904863b0fa0da07ffab78
- SHA1 04a5779d1943d4df8de84c6f1584a750184a334d
- SHA512 a1868f1dc4dae769da931c83207fe06df68ff67253056cc618202965566c624ee60b0da1527656e0a8530e88f67fd30aac87d1c3027a1477d460b0c23f88a690
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2a:JrOO53z48t7eUJF3noxDN4Zjo
- TLSH T15C365B11B6608631D073C171C592FA9DE9323C519B318ECB2285BE9DBFB27D29936732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2392-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c41-33.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a170-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9a-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000018973-1361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000188a7-1472.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2392-1511-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5436-1530-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5436 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe - Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2392 2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe 5436 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_21956e37e9d904863b0fa0da07ffab78_amadey_darkgate_elex_glassworm_hawkeye_luca-stealer_njra.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2392
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.8MB
- SHA256 32f21c00fba848f071c0b23c92d255097ab841c3065ab249e81fa1dda3a67f18
- MD5 21956e37e9d904863b0fa0da07ffab78
- SHA1 04a5779d1943d4df8de84c6f1584a750184a334d
- SHA512 a1868f1dc4dae769da931c83207fe06df68ff67253056cc618202965566c624ee60b0da1527656e0a8530e88f67fd30aac87d1c3027a1477d460b0c23f88a690
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2a:JrOO53z48t7eUJF3noxDN4Zjo
- TLSH T15C365B11B6608631D073C171C592FA9DE9323C519B318ECB2285BE9DBFB27D29936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 5.2MB
- SHA256 0c06a80c0ff05e63969c04a83836f382cc2c7f8a4601bb782b1eb9dc2b85777d
- MD5 4a5d2f0dbbe881bc34b3a6271d4bd3c5
- SHA1 ac0e976ff3ac874f11e498ff89f939d9c98c18ca
- SHA512 9f2e8ec696649b4158941db0ceec09512c73aabe4df8b2033619986d4eeb41e65d7b1dd00414696f6e1355e17ecaa6d67a74d45338093be0140140368728ab96
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb20:JrOO53z48t7eUJF3noxDN4ZjorI
- TLSH T1B8466C11F6608671D073C130C592EA99EA363C519B318ECB2285BE9DBFB37D19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 4.9MB
- SHA256 aba2b9aeccb94bd34bef25fb3f0761baea67b1a302c639f0ff11fae1158c8dba
- MD5 4b285fc9e503a00a8af49b85df750e39
- SHA1 79502ef23539c9a9826f0a68c846b1d365becf3f
- SHA512 f837a37b50ade6f4f62867cb32aeecbede9ed594c68beaa7d422b3b78f09920d984ee7242c0ce92f0367b7ee7ad70bc0a30acc0ed2998d9707170c94bf1c8f45
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2O:JrOO53z48t7eUJF3noxDN4ZjoF
- TLSH T1D7366B11B6608631D073C171C592FA9DE9363C519B318ECB2285BE9DBFB27D29936332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.4MB
- SHA256 7ac939af4b38df5c3fdf8463791fccd91c5cd850bfbd182bba5e683679c61d19
- MD5 bfe060c1592a2aebb6c93de278645f4d
- SHA1 878ea2b928e8a1daa84363d31b714b55f648983a
- SHA512 0f3152359f3fc86b8f2fc78dfdbafa6a289465067f02d27a4c5cf3bfd3f3c7881f0d70732057af0562f969798dacb0935fdfd35e5bbec2670537e2646d1290e1
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2y:JrOO53z48t7eUJF3noxDN4Zjo0jo
- TLSH T136466C11F6648631D073C175C5D2A69DE9323C519B318ECB2285BEADBFB27D28936332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$
- Size 4.8MB
- SHA256 1ab1000af73dae58a19b8c981e47237a46e98c6cbdad92dcf79896ed186eb884
- MD5 8c2e040e67315c9ec229a28dd08d343e
- SHA1 ccb5d9692e94943a4eb8a4bdeabe98855d596448
- SHA512 7efb76927ab35577cc8576e46dd1e809b30c81de8c58212bc0b4173c7fcd3ae0ba6d5ddb7f650e22f3a2f2fcbbf9bb0d2049672882acfd00380bad587d40719a
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2a:JrOO53z48t7eUJF3noxDN4Zjo
- TLSH T1A7365B11B6608631D073C171C592FA9DE9323C519B318ECB2285BE9DBFB27D29936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.9MB
- SHA256 6201b1e6ef52f441b338489e4a63e7987dcb615ffddcb5d0bb9a6100abb094e2
- MD5 36375c743a2f6844f800c6bf53691f83
- SHA1 777c28166f6d3c6346ddeb3f13ddf33ca394dcbd
- SHA512 9e6797351515b3ffca2afa16b98740b5ed3b5845583cfb2b91d727578c2cc4399e9e56f5be7d6bedddba102d074bacc6e44c7eb8c2dcfb1ce605b31c20ec60e1
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb2s:JrOO53z48t7eUJF3noxDN4ZjoX
- TLSH T125366B11B6608631D073C131C592FA9DE9363C519B318ECB2286BE9DBFB27D19936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 4.9MB
- SHA256 49b842bed1254e568bc6beb4ff0200ed478f1631fda6c9f2f32e4d813ed21763
- MD5 e7c4b21035a0e50af6a997a05f4c646f
- SHA1 807e76a8a60d8f2078da19e43f61f6cb8217ab2f
- SHA512 91e274ea9ed9c108dc37430840db80c7e75f2f4736f3497fbd37607aabb4caaa7caab6946e1b16f30108820914b709ae271519de506380c2035840d0b2353acb
- SSDEEP 49152:i4/rOO53RTqtiKKeJJ8y5XcY/+ljR8xmN3Aek03noj45wlDThqJtb2IKTuqJtb21:JrOO53z48t7eUJF3noxDN4Zjo2
- TLSH T112365C11F6608631D073C131C992EA99E9363C519B318ECB2285BF9DBFB27D19936732
- MD5 SHA1 SHA512 SSDEEP TLSH