Analysis
- max time kernel
102s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 01:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe
- Size 3.9MB
- Sample260802-bsnq3abl5v
- SHA256 4a5f390d860de7be55332eb663855df1f507c5ce23c21de229ee485b32b772bd
- MD5 07a4871586156720f522e1c412906871
- SHA1 2bcee633c4ee70165b32f1b52ff01a7788dd7b50
- SHA512 98577d6f1eea7025ddee7f7a19b7aaaff02573b1a289bfd779dea6fb9c446fc8b898505eed98f4bfbb42754028c7a9e28681dbc1c865b9ac01b34bb13508d2ed
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2Ig:OWCYdK9Fgjo+Xr
- TLSH T1A4164929FEA48A21D0B68075CAA2A75EF9363C410B6085CB5285F77CDF32FD19576323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233b2-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5384-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000245d3-144.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2824-844-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5384-845-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000000729-955.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000006d3-1070.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 5384 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe 5384 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_07a4871586156720f522e1c412906871_amadey_cobalt-strike_coinminer_darkgate_elex_glassworm_h.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2824
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5384
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.9MB
- SHA256 4a5f390d860de7be55332eb663855df1f507c5ce23c21de229ee485b32b772bd
- MD5 07a4871586156720f522e1c412906871
- SHA1 2bcee633c4ee70165b32f1b52ff01a7788dd7b50
- SHA512 98577d6f1eea7025ddee7f7a19b7aaaff02573b1a289bfd779dea6fb9c446fc8b898505eed98f4bfbb42754028c7a9e28681dbc1c865b9ac01b34bb13508d2ed
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2Ig:OWCYdK9Fgjo+Xr
- TLSH T1A4164929FEA48A21D0B68075CAA2A75EF9363C410B6085CB5285F77CDF32FD19576323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 4.4MB
- SHA256 4fb39c3425205fbd2661db3e49c5b49eaba2233c5527f177f815a401eeedbfc6
- MD5 7be9ed991c1349acf798ecfb4d8958e9
- SHA1 7201092c4fb2ce25bcd05f4e372253e57db6a28d
- SHA512 db0809235ab848e5f4aa69d4882def064600df8ace9d0e6a2fea423e9f8a9d627bc7d07d8b830a7329c2d8d516f818d439c19b3a329d92663674cc33f9b63303
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2IMUidGl:OWCYdK9Fgjo+XbdGl
- TLSH T1B0264A29FEA48A21D0768075CA92975EF9363C410B6086CB52C4F77D9F32FD19A76323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 2f027dd7b40f511b208ba6368ce5e807cd0eca10df7eecd3a5d057404ebffbe6
- MD5 a696a2d970fed7dbcac13055a0d28b1a
- SHA1 0f916f115949dfe11323580633623f3fc334f4fa
- SHA512 3e923f3302c155d19a245176c67c1a5cab46ccddb567fe2df13202740777cc793dd133aacce61c6803e29c352e3bf1aec62487b7d1ff726d42a0ea2bd2f782b0
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2I4Pji0Aj:OWCYdK9Fgjo+Xfjo
- TLSH T17D263929FAA48A21D0778175CAE2A75EF9323C410B7085CB5285F77CAE33FD19576322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 4.1MB
- SHA256 0497a2ff2b97c7cd78740de6dfaad44ed50764456960f8faf63bf17b951fa526
- MD5 712c63a3550e98441204ece1e9203771
- SHA1 0972f18ee9d4b6a6746ba26c74df4e5647f5a7c8
- SHA512 5abf24e891bf7cc0f677f7a6e00867bf210e44065e334384b7f89f54da1c26219996f299485d5372222a3b77629a520174ea8dabb3e6752c13d443e881d974da
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2Il:OWCYdK9Fgjo+XQ
- TLSH T100162929FAA48A21D07A8175CBA2975DF9373C410BA085CB52C4F63D9F32FD195B6323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 4.2MB
- SHA256 233ecd8ef803eaf285ffea772cc2e0dd36bcc89b3f5770fd7fb728e7ff72eae6
- MD5 d836af77feb2d9a6aa30263091212024
- SHA1 b0b2bb067a4a8a11ec9ed63020b4da2f1a95bdab
- SHA512 a58f7672ffa811c2c3644121f2ec4dafeeb45d0e9ebf82d439763ab80147a14769e6c1408f4563a89ed8133639e7e4e242ca7e5af18a3dfef3a681902a790d13
- SSDEEP 49152:ggnToIiISydB3IGLKEzW9VfWdPji0Aj6qJtb2I0qJtb2Iii2WH3:OWCYdK9Fgjo+XzuX
- TLSH T14C164A29FEA48A31D0B78175CAA2A75EF9363C410B6085CB5284F73D9E32FD19576323
- MD5 SHA1 SHA512 SSDEEP TLSH