Analysis
- max time kernel
111s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 17:06
Behavioral task
behavioral1
Sample
2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 1.4MB
- Sample260810-vmr13stdnb
- SHA256 835f0696accc6d35f7f35554ebdf174cc315fc85a3b10c2b7897356ee3adafe5
- MD5 d4558391ae87b79ffdb309b8d949d5dd
- SHA1 9bc1a4ab6962e611c7b2aa08d88c643a888d63ab
- SHA512 6b5fda204a38855319e28d0e06cd5f9ae577f157f912df817a97a4873218cf6baeaaf822761ac00cc58fa072b10f614b101058d179aacde2cb93bb617665fd70
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69te5jcAkSYqyE:A3kMPlj3pYq
- TLSH T1B3659D22FA748575D073C4B5CAE29756EE3534520B308ACBA398C7682F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/3572-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b7f9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016b53-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3572-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3052-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b7b-685.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b70-687.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000300000001b7f9-5.dat aspack_v212_v242 behavioral2/files/0x0006000000016b53-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019b7b-685.dat aspack_v212_v242 behavioral2/files/0x0003000000019b70-687.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3052 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3572 2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 3052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d4558391ae87b79ffdb309b8d949d5dd_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3572
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 835f0696accc6d35f7f35554ebdf174cc315fc85a3b10c2b7897356ee3adafe5
- MD5 d4558391ae87b79ffdb309b8d949d5dd
- SHA1 9bc1a4ab6962e611c7b2aa08d88c643a888d63ab
- SHA512 6b5fda204a38855319e28d0e06cd5f9ae577f157f912df817a97a4873218cf6baeaaf822761ac00cc58fa072b10f614b101058d179aacde2cb93bb617665fd70
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69te5jcAkSYqyE:A3kMPlj3pYq
- TLSH T1B3659D22FA748575D073C4B5CAE29756EE3534520B308ACBA398C7682F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 4bfb0bf2353199380ad339bd45fad3cf8b5994f87357f362df6b738b660b6e7c
- MD5 a39c6d87f9966eb389e0f92ee9312a0e
- SHA1 af826969d60a6cd4d05a8d3a25bf84d5a63ac06b
- SHA512 7db9e71c5a631512f38723fded3070955534a79bc955d2af41affed89e2a19d0b854ed3440d00efe9dbde57841b5b812599d0e8737f8bab32265a9bf51cdb985
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69te5jcAkSYqyED0Le5ji0hmxNrM:A3kMPlj3pYqjPji0Aj
- TLSH T1BD956C26F6748675D073C0B9C6D2A75AEE7134420B308ACB5399C76C2F277D29A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 1.4MB
- SHA256 11cb305394e605d0fc84e6c2b4cdba343afc850e0d0971de5be52c60f6e62fbd
- MD5 e88462e1fe560aebbcd1634bf4a2fa74
- SHA1 4a9a2f28a7253818a166160dd4a51c9dd517d78c
- SHA512 74d8a65327c370b209de62af942a6da9c22ff99c8d0d49dc1bd7839ae404e1be33fafee46c2869605a788054f8de5ea8c07ecc68f03063b3250e38a928ed688c
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69te5jcAkSYqyEjs:A3kMPlj3pYqI
- TLSH T1C1659D22FA748575D037C4B5CAE29756EE3534520B308ACBA398C7682F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe$
- Size 1.4MB
- SHA256 07cd6a9f72036798521919683f38cc96eb1934c5ddefefd0fe6bbaaf5be5b4d8
- MD5 717038012091ce1096f5590e82045037
- SHA1 ad96500168f53192041610142edcc0325cf0f2e7
- SHA512 a177ffd67e10b799abc07071d310ddaaf43d29a9f261f3a2ca3d3b1bd52d670d1b0822b378585a3c6e431cae32326f953370503330962abdab89781aabaf5335
- SSDEEP 24576:A3mnXoZjzyaT4aewsAjxTc6Yc69te5jcAkSYqyElT:A3kMPlj3pYqp
- TLSH T1B1659D22FA748575D037C4B5CAE29756EE3534520B308ACBA398C7682F237D19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH