Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 11:37
Behavioral task
behavioral1
Sample
2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe
- Size 11.3MB
- Sample260808-nq9a7sem7v
- SHA256 badabc9874c77ecd595b8bcdf9d1d48652f144a375eaed1454f10ef8eaeb23aa
- MD5 9774749b32eaa75b3f090ed921499976
- SHA1 794c9150d0d4f072a2c178da381dc200b888d028
- SHA512 800c996a7dc648d467213f1ce703b7c50f95ce831b617939c3a0a42378888786da2a299af058644376e84743f5a849a8213d2044b3d9d44eb3b3db30efe6d8c7
- SSDEEP 196608:CM1MTv9sXLCyeGZF6bUpMBF1p/kjRm4OWi2bc:CMcv9WOqIbUwF1VERmj2bc
- TLSH T11EC6BD2166E1CFE1D26F2071CDA6BAF5512BAD20CF114FCB6A843F1939305D1AA35A1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\winver.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\net.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe -
resource yara_rule behavioral2/memory/3652-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c451-5.dat upx behavioral2/memory/3652-401-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3652-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\sdchange.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.26100.1150_none_d9f89d43802b0109\bootim.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\mspaint.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\OpenWith.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmLpac.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\r\logagent.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\NgcIso.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15912.0_none_07ea43e35ad4fd3b\MSBuild.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\chcp.com- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_10.0.26100.1_none_19e613be108c5c51\fvenotify.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1150_none_5cbb86162cb9f00b\wevtutil.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15912.0_none_6f42c7c83cc3cb06\SMSvcHost.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\r\CertEnrollCtrl.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\r\WaaSMedicAgent.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\SnapLauncherProtocol.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\r\dccw.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\r\shrpubw.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.26100.1150_none_430cd619cc4d0de3\r\upfc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_af2434cfb8eecc10\clip.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.26100.1_none_b0088cffd56138b1\djoin.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.26100.1150_none_b68ce2ecb8338725\ConfigSecurityPolicy.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\bthudtask.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WMIADAP.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\r\regedit.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_012b81e0c046e57c\wlanext.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingSvc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\r\dxdiag.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\r\curl.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.26100.1_none_ddc589fe5044ffed\MSBuild.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.26100.1_none_fa99cf8592f76fdd\systray.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c6c9a6c536b87ee9\mscorsvw.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9774749b32eaa75b3f090ed921499976_agent-tesla_amadey_darkgate_elex_glassworm_hawkeye_luca-.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.2MB
- SHA256 0bfc61d7f5a7108550fd78560e6445b92b189c43c9b17d8e2893f97281a33207
- MD5 b5e19d8b1e4ca00edc3352a731cf4e02
- SHA1 6c26dbe927fba399a8dc33727d40b75362d0a1a7
- SHA512 fa8c52c5115bfaa0ce34d3200a99539c79c14ebb9a5b7c3dd2f6a2683fa6737588d5799591dfe9632c4fcc7404d8a927f4904fe29714eece38a3b72103eefb5c
- SSDEEP 196608:CM1MTv9sXLCyeGZF6bUpMBF1p/kjRm4OWi2bSZ:CMcv9WOqIbUwF1VERmj2b2
- TLSH T128D6AD2166E4CFE2D16F5071CDA6BAF5A5277C208F214FCB2A407F1839316D1AA3562F
- MD5 SHA1 SHA512 SSDEEP TLSH