Analysis
- max time kernel
118s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 15:36
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
- Size 5.0MB
- Sample260801-s2b73azbma
- SHA256 75c350155b7af5cd952b18cc21bb3cbba6cc299fdc3bad3661d4ce80c5d51b38
- MD5 e24349a9d33f8525c3493b729e649ccc
- SHA1 bf15033cd92dbaee4398a67551bc86186b7e00c4
- SHA512 a1b80480bc9fab42d93151e9db6b55e52cec4333274880b1d6b2659a3278cb6a92f4629c4c9e8d2971a30630164682422aa92545f44394987c9d10259b35cdd2
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPW0:NmAE9695ta1pPq
- TLSH T16F364911F2F88622E0B79575CAA6AB1AFA727C410B7086CF1384F66C1E337D19975723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5060-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c561-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-459.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000019d33-1246.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5060-1357-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00090000000189a4-1358.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4364-1372-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4364 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5060 2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe 4364 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_e24349a9d33f8525c3493b729e649ccc_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5060
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.0MB
- SHA256 75c350155b7af5cd952b18cc21bb3cbba6cc299fdc3bad3661d4ce80c5d51b38
- MD5 e24349a9d33f8525c3493b729e649ccc
- SHA1 bf15033cd92dbaee4398a67551bc86186b7e00c4
- SHA512 a1b80480bc9fab42d93151e9db6b55e52cec4333274880b1d6b2659a3278cb6a92f4629c4c9e8d2971a30630164682422aa92545f44394987c9d10259b35cdd2
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPW0:NmAE9695ta1pPq
- TLSH T16F364911F2F88622E0B79575CAA6AB1AFA727C410B7086CF1384F66C1E337D19975723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 5.4MB
- SHA256 15b2fa21acda8b79c2aa372af404d8382d7625a58d0219d0a7c4768ed9688854
- MD5 0ec63d3e6db66c0ba0465adf4e0a1a18
- SHA1 1847566c22373cd511076affec3fcd5cafd0143c
- SHA512 d93fb3e13aebd321f6957aef7333077e65e2967f605f78638146526d235617e035ff826afbbe097c357055c03c791665262bceaf8c8dccdc2147a9b45463dfc5
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWm:NmAE9695ta1pPg
- TLSH T188465911F6F88662E0BB9535CAA6A756FA727C410B7087CB1380B36C1F337D1A975722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.5MB
- SHA256 8861fdf7a4bd5e5d759809b49d96fcfba8f31bfa8383c37953a042456892abd6
- MD5 5ca8c82eea6d27c788a57d685d890fec
- SHA1 9959602e63d1cf66047314248c8ace9de2f33314
- SHA512 844388383996d1f5758f96ca3b7f05e52b2d1fb4914b9e903128be0e1e6e19af04be59a0301eb149a5bcf4f9efa09d42df23309235e1f73cf64d6b87aeaff938
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWz:NmAE9695ta1pPio
- TLSH T1AB464911F2B88622E0B79575CAA6A75AFA727C410B7086CB1384F77C1F337D19936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 5.0MB
- SHA256 01bb98e5b0570650cfaefad154a0886deaa22861a1668a19bd62780ff540af8a
- MD5 796c4adf4f51036937f2d27404a2a0e9
- SHA1 1a6093295523dbbb9be9bbbd41a12e01f4299e69
- SHA512 f3d34961d1bd00d273de2bf6623cc01eb333fe65e7cb535a82cbdda8e100ef0d51e974fb00c320ec5d5fcebd5edd25357c58b5f3bf0e7108bed3aa6883653716
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWe:NmAE9695ta1pPs
- TLSH T1D0364911F2F88622E0B79575CAA6AB1AFA727C410B7086CF1384F26C1E337D19975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 5.1MB
- SHA256 e3d52f096e51582e09762dfb316c70eda88ade0e50a7a6ef6a1d3473111c8d91
- MD5 37c916bfbd078770347f9caf395306d9
- SHA1 169c334aeab34ab0bb0e6cf767508a9d550d3697
- SHA512 2384be4c5d43f92ec1e541555cb362f066e827979b334040ffd1582e6c2c53f6b0519a1660ac8588f9d330d6ce97f699eb69b1b9b3102be03cb7eeea3d4856b6
- SSDEEP 98304:E+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWE:NmAE9695ta1pP6
- TLSH T17D364911F2F88622E0B79575CAA6AB56FA327C410B7086CF1384F76C1E337D1A975722
- MD5 SHA1 SHA512 SSDEEP TLSH