Overview

overview

10

Static

static

10

2026-08-01...hi.exe

windows10-2004-x64

9

2026-08-01...hi.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    83s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/08/2026, 19:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_e87aa825560f1f53f40981e0699db37e_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe
  • Size 2.5MB
  • Sample260801-xnrg2sfd39
  • SHA256 3b605eaea0f13809a568386b35f2a8cf90135b8e00167e2de75726b4ce14c127
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
discoverypersistence

Malware Config

Signatures

  • Detects executables packed with ASPack 13 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_e87aa825560f1f53f40981e0699db37e_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_e87aa825560f1f53f40981e0699db37e_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe"
    1⤵
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    PID:3308
  • C:\905c0769f9a06c95a24ddf945\patcher.exe
    C:\905c0769f9a06c95a24ddf945\patcher.exe
    1⤵
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    PID:5028

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        patcher.exe
        • Path C:\905c0769f9a06c95a24ddf945\patcher.exe
        • Size 2.5MB
        • SHA256 3b605eaea0f13809a568386b35f2a8cf90135b8e00167e2de75726b4ce14c127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedge_pwa_launcher.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
        • Size 2.6MB
        • SHA256 802bbf44b7cce7b80d2e75a8bed5c40e5f5e1c5d262551e7013c5a08cc4c68a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        identity_helper.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe
        • Size 2.6MB
        • SHA256 df3f30740122a77d1c227f80f593dbe3699ff191e897a0cf1c2bf515409a2be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftEdge_X64_139.0.3405.125.exe$
        • Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
        • Size 2.5MB
        • SHA256 29fc754330630d5c58332fff2e8f450c4d7cc18b87f0340a9810d9389efcedab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7z.exe$
        • Path C:\Program Files\7-Zip\7z.exe$
        • Size 3.0MB
        • SHA256 da02df26169437f1bcb0e5e62069cb17bbcec15c4a6b607c17359d893f78d016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 2.6MB
        • SHA256 de760d9d52e5ea7a3e7e18c0f0762a56ac09a2a66bca9419c2a3c9c93ba4d6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe$
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$
        • Size 2.5MB
        • SHA256 af0eea0f0ae1f379d1a5e72e197b97aeb929fcfcbedac2076e14a4f91c3a2f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        misc.exe$
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
        • Size 2.5MB
        • SHA256 b45256237bdd73e33aac7f737e5a36c238f1f8e9820654baf22e7ca2514b20d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Workflow.Compiler.exe$
        • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$
        • Size 2.5MB
        • SHA256 75912f170d9cc00f4ae87a6e7a5a1d1b1787fc998fcf908de8e110659af50238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3308-1714-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/3308-0-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/5028-1841-0x0000000000400000-0x000000000040D000-memory.dmp
        Download

        memory/5028-7-0x0000000000400000-0x000000000040D000-memory.dmp
        Download