Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
- Size 10.7MB
- Sample260808-vrkskaan7x
- SHA256 deabac35f18c1bd06b1e216bb9b034c14e1555e694ceb2ce1a3bf4a6749e4293
- MD5 d3a00ddb5abd66fae92620060f32dfbd
- SHA1 7786d953721eb11de2044112b0a66c2001ccae4c
- SHA512 9c622956f8297173cf753709c0fc55d6838d8d78234bb53775757b8ada7e4da17224a31bfe6183b2f4abe9b2e168f90021e07d4cf65e3fbc04e46098f32209e4
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bT:4pTnLdzZIbUwF1VERmj2bT
- TLSH T189B6F11276D08076D1B381718F76E716E679BD220B3096CF73A81A5E1F32AD16A3B713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\find.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\more.com 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_a94df8cb819b49c2\more.com- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\slui.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1591_none_324c8f3af62cc63f\r\dtdump.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\r\WSReset.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.26100.1742_none_8907e35eb88d8d7f\convertvhd.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\appcmd.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\RelPost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\SyncHost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\typeperf.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\AggregatorHost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\fc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPDCT.EXE- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_ccee7580f3b9f072\MpCmdRun.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1150_none_714a211aef7dc47f\eventcreate.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_70acf1931a9fbc01\InputSwitchToastHandler.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\recdisc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1_none_743122fc48bb736d\CameraSettingsUIHost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\r\curl.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1150_none_08d020c05bb7ff70\CameraSettingsUIHost.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_a2039c43d1b59b62\setupugc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\DmOmaCpMo.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.26100.1591_none_5d054cd1bd51eff3\r\DeviceEnroller.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\ResetEngine.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_69287f183fd23745\aspnet_wp.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\wininit.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.0_none_b4e0bc75d19eec35\ngen.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1_none_748c8913fa792db3\cleanmgr.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1150_none_b5750378d5419664\fltMC.exe- 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d3a00ddb5abd66fae92620060f32dfbd_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_ha.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.7MB
- SHA256 a7cfd3bbfc72110105a64741ba7cb152dae6ac4345b47ea3fc82b2e6a0b15d10
- MD5 2fd2016e2be9330d432f3eba2b6441f2
- SHA1 b92a7ea5b6449aa8ef02d1f5b5552aacf63cf00c
- SHA512 d50b942aaeca8f1c666500068e540c9318bad7eac9f53572fa384cdeef231283675cb8aed0de4a5cbac7f3f7cb2cd9cfacaf29798afc0c95b2108dbd18778755
- SSDEEP 196608:tipKDcp1LdzXdXeGZF6bUpMBF1p/kjRm4OWi2bfb:4pTnLdzZIbUwF1VERmj2bT
- TLSH T169C6F111B6A48276D0B3C075CAB6E75AFA7578120B3086CF6398471E1F337D19A3B726
- MD5 SHA1 SHA512 SSDEEP TLSH