188d36f31dfdeb794e3fb0af9c71d21d8788ed7cf90ad8274f81172f9dcbe31f

Analysis

max time kernel
94s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Size 1.9MB
Sample260811-2p3nxstdlc
SHA256 188d36f31dfdeb794e3fb0af9c71d21d8788ed7cf90ad8274f81172f9dcbe31f
MD5 5f959d6ed00f83246dd4e6b685e06fab
SHA1 00a3a47453d64827b7bca40895cba9240cd48c2d
SHA512 41f791ed90c6437d649bbaad938d8060c8f3ef65faf45c4fb55b35f577837e854966a489f22d904a7980b680d6fe1d30d3d0ab9d51de9b99e299a0e72f914fb4
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwao955jcAkSYqyED0Le5ji0hmxNrM:T2agnTkLfUqpYqjPji0Aj
TLSH
T1F3954B26FA7486B2D073C0B9C9D2974AEA713C410B3086CB5295E36D6E337E59E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 7 IoCs

resource	yara_rule
behavioral2/memory/2932-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c523-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2932-15-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4736-23-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a9fc-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac7c-1199.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c523-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001a9fc-1010.dat	aspack_v212_v242
behavioral2/files/0x000300000001ac7c-1199.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4736	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2932	2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
4736	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_5f959d6ed00f83246dd4e6b685e06fab_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.9MB
SHA256 188d36f31dfdeb794e3fb0af9c71d21d8788ed7cf90ad8274f81172f9dcbe31f
MD5 5f959d6ed00f83246dd4e6b685e06fab
SHA1 00a3a47453d64827b7bca40895cba9240cd48c2d
SHA512 41f791ed90c6437d649bbaad938d8060c8f3ef65faf45c4fb55b35f577837e854966a489f22d904a7980b680d6fe1d30d3d0ab9d51de9b99e299a0e72f914fb4
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwao955jcAkSYqyED0Le5ji0hmxNrM:T2agnTkLfUqpYqjPji0Aj
TLSH
T1F3954B26FA7486B2D073C0B9C9D2974AEA713C410B3086CB5295E36D6E337E59E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.4MB
SHA256 9a9551f5160cce64f5ecd8ae2abc45445d367baa2972189f4ee8ee1aafa9748c
MD5 c17d97b285616c4eb1a0b05d1b5b758b
SHA1 b01e1fce3b57429cd286ddc844f35abd69bcdc01
SHA512 e3ecacb919a8a6b93690459944085382a64fbeb27b25e46a178993b6e3012a84789ec4cde1efdd51e3faddd949be33e69cb64fdae3130389feb8987a6a963ec0
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwao955jcAkSYqyED0Le5ji0hmxNrMD0Le5ji0hmxNw:T2agnTkLfUqpYqjPji0AjKPji0Aj
TLSH
T178C53B26F6748771D073C0B9C9D2978AEA7138810B3086CB4295E76C6F377E69A36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WORDICON.EXE

Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
Size 1.9MB
SHA256 4f691ab28f8f3566c21224af2a46a36a7a6b6cc3d85fc5ee275e450793cbae66
MD5 519e6b2ef8d618a655e7290020fcd99b
SHA1 531b2091aae0653c5ffbdc693c094ea54c1d9c0c
SHA512 572fc75983363e75ec0f66b70e67686032f84fd071f472f67b2cbbb13d33f0a87071f519aa25d7b66a7e07439faa914481f440612d283d5651010afd6e40f2f1
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwao955jcAkSYqyED0Le5ji0hmxNrMuwE:T2agnTkLfUqpYqjPji0Aj7
TLSH
T191954B26FA7486B2D073C0B9C9D2974AEA713D810B3086CB5295E36D6E337D19E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmclienticon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
Size 1.9MB
SHA256 def66200db528146ac6374b7756dbdaa1437b286b0bbc67ea16b7bc984b89fdc
MD5 0e6702e7dc17b09bf264971c304c473c
SHA1 d66e5eb10363537a84c28a0b8be18faf172f7efe
SHA512 a8165e42aa33a2944fd64d50c476d54daa4e7b68d733c3977b2c24a17f300348cceebfcb90ede73f2a826d829237e2f9af8071be0c87168815cdd9caf4480226
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUwao955jcAkSYqyED0Le5ji0hmxNrMg:T2agnTkLfUqpYqjPji0AjX
TLSH
T15F955C27F6748661D073C0B4C9D6974AEA317C450B3086CB52A9E76C2E377F1AA3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2932-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2932-15-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4736-23-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads