Analysis
- max time kernel
78s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 09:51
Behavioral task
behavioral1
Sample
2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.5MB
- Sample260809-lvvmhadj2z
- SHA256 e17211cff7b7f44893ec7efcd2303bd2ae5763116f61fddee6140669f34d7a05
- MD5 be810f356b795963edb3a262611a6454
- SHA1 5a693d028a472952fe54de3f090808a352f6fb4a
- SHA512 723818bb31935540aacde1620f646cdf1e4bd152a8d7e8f4a04454f46f9d45e3791dee5f540b57bc177549e76293b122e47374ffe8b9acf4d0522f892efea136
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPF:A3kMPljppYqt
- TLSH T1FD657C22F6B48171D1738075CED29756EA353D910B308ADB6398F7682F337D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243e3-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/652-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2316-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/652-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021673-1264.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000006d5-1543.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1968.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243e3-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021673-1264.dat aspack_v212_v242 behavioral1/files/0x00040000000006d5-1543.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-1968.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 652 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$$ 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2316 2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 652 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_be810f356b795963edb3a262611a6454_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2316
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 e17211cff7b7f44893ec7efcd2303bd2ae5763116f61fddee6140669f34d7a05
- MD5 be810f356b795963edb3a262611a6454
- SHA1 5a693d028a472952fe54de3f090808a352f6fb4a
- SHA512 723818bb31935540aacde1620f646cdf1e4bd152a8d7e8f4a04454f46f9d45e3791dee5f540b57bc177549e76293b122e47374ffe8b9acf4d0522f892efea136
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPF:A3kMPljppYqt
- TLSH T1FD657C22F6B48171D1738075CED29756EA353D910B308ADB6398F7682F337D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.0MB
- SHA256 1069d9ceb90e4fb427538ca48a1150dd0bb57f98d9b385b4f56b7d0bd18b3264
- MD5 2db6b32bab679ed1b0e3bf3669154ce2
- SHA1 9a3c3cde776cb36fbb9fb5133ca751cbba924c36
- SHA512 69f73c6a87fe952ebe652c0b9477409fe19195a93fc25cb3774fd2939a546477df29fc6de94fb6bedd636fc4b92a87c9b7835b81639cd7eda7d4ebaa0aec989e
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPI86n9kAJ9tA3L:A3kMPljppYqgT9t2
- TLSH T132958C12F6A482B5D0778074CE929746EA317C910B309ADF5398B7792F337D1AB3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 3aba17d469d8394172741a01feafb8305105bb6d10291e21f9f62ffa68ac83bb
- MD5 a342fb34ff2175fe0c31861cbcfe29f7
- SHA1 da1baf576e7b0b4db17df8a488a9ca3dbbb9783a
- SHA512 1ae1a925b69bfc0e690416e9c99aa3d5666e1bbaf2a5d82fb5ecf51428a037e6c51aaf074b7779eedff60f1865b49fd86d857da71f81443c9eca1ae29a95c5ca
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPB0Le5ji0hmxNrM:A3kMPljppYq5Pji0Aj
- TLSH T17CA54B16F6B48275D073C0B5C9D2975AEA313C810B308ADB5399E7682F377D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 2ef565167f7b2193ff813c810aff6c542298ba0cbca9816ebcc0ab12d6e717db
- MD5 887125599c5852504e223dd84be1482d
- SHA1 7bb6eb7080a8cacc8423b576cf9cb29d86b1485c
- SHA512 4597b80459e65cbd7b298de16c4524046f6d805fa4c9c47bf9d6e73d7420b1f68370859d0783479d402e80b79b77333d834bf3b058c385d6d83995d6ce192608
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPRF:A3kMPljppYqL
- TLSH T1FE757C12F6B48271C1B38075CE969756EA357D810B304AEB5398F7786F333D1AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 2879e5f411c593e21fbcabfeae6afac0e2ea8fd59aeb6bf2600730c3ba2412ee
- MD5 ddcc307ad84e4c89d388bc81d392e74a
- SHA1 728986d1dfe4089315530543318ba8d59f01c917
- SHA512 6fd56343db7d03506d06828882d10f7b3feb3c08846c9430e7dad7621d5ca2ec702f3509dedca2dd2554fe642aa41b7578f99d93fd810df6aad79544c8fdb013
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc6hs5jcAkSYqyEPg3npi63iC:A3kMPljppYqYXpiMh
- TLSH T16D956B12F7F48131E1B38671CEA69656EA357C514F3086CF6398B72C1E726D0AA35B32
- MD5 SHA1 SHA512 SSDEEP TLSH