Analysis
- max time kernel
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 06:54
Behavioral task
behavioral1
Sample
2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 1.1MB
- Sample260813-hpatcssyey
- SHA256 4c6462ff1fb6381025873fd66361531ce4b895f4084114bcfdd7f5de7ca8574c
- MD5 2668d598bddf57c0ac6fc71dd0fbb76c
- SHA1 c9ac89c1f395a7ffaad0af4b9499707257745063
- SHA512 e8c1621b17896851edc9186675de6568d7491a41e7f297f46e20636b210236830295789136dc93f6fc401dee4576cb98ba1c9a7ad275d1bbc4a8703548ce9ef8
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYasau8OXsf3z:bHuHNgHg1flT/Vk3HYwLfUjYasau89D
- TLSH T1FD354912DA6448D2D6AE4470CB968601B637BD610BE192DB92E4F33E5F323C06EF6717
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 7 IoCs
resource yara_rule behavioral2/memory/3368-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3368-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1548-34-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a307-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ace5-1298.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001a307-1020.dat aspack_v212_v242 behavioral2/files/0x000300000001ace5-1298.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1548 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3368 2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe 1548 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_2668d598bddf57c0ac6fc71dd0fbb76c_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 4c6462ff1fb6381025873fd66361531ce4b895f4084114bcfdd7f5de7ca8574c
- MD5 2668d598bddf57c0ac6fc71dd0fbb76c
- SHA1 c9ac89c1f395a7ffaad0af4b9499707257745063
- SHA512 e8c1621b17896851edc9186675de6568d7491a41e7f297f46e20636b210236830295789136dc93f6fc401dee4576cb98ba1c9a7ad275d1bbc4a8703548ce9ef8
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYasau8OXsf3z:bHuHNgHg1flT/Vk3HYwLfUjYasau89D
- TLSH T1FD354912DA6448D2D6AE4470CB968601B637BD610BE192DB92E4F33E5F323C06EF6717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 ef96cd3263fdf596db9e505672bf1e28544b34512e7639b1f5c9a7b0d03c953d
- MD5 78446ec3ccec1ab52e5f3bf176858d44
- SHA1 a79178244da4432af9d3e617cd84d797a815a7c6
- SHA512 b6fb087d9c669075d9f5a0b1111d44ee2d6d7a3aa716bf458622b4900a66f0d55bddf50dc0cac87747f7d69b8cc5ea152f581f6cd11250ab0cde474fa6a40df0
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUjYasau89/0Le5ji0hmxNrM:T2agnTkLfUXPji0Aj
- TLSH T17C854916EA6446A2D07E8074CB929646FA337D510BA086CB82D4F33D6F337D15EB6723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 1.1MB
- SHA256 135047a37fea557e2ab44c50a12400e0cefc653d2af63ee6b7428589c6a82022
- MD5 3dbc41551881047239dbe8cd290518a4
- SHA1 431331e255022c4785abb1b0b6572b011437c3f8
- SHA512 78514b3de21a9d1e2310337a773d4076d85d82dcccf8b3dbe4fb75d5742ed2a9995a0e5f7636cc07dc688daa87b16bb9c9ae9c433776f7a232e9a0eb87678562
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfUjYasau89CwE:T2agnTkLfUw
- TLSH T11A453912DA6448D2D6AE4470CB968601B637BD610BE192DB92E4F33E5F323C06EF6717
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe
- Size 1.2MB
- SHA256 90baf19eb56b5b549a941746af7f8d5970714bb8324ab1ff85e9a71651466202
- MD5 36ad61a294f286c8c4927a019218a81b
- SHA1 ff94b3377868f7c1ca3b5d4d5a12b85c39c755a3
- SHA512 73be03e13533538a336c94da7c49c75988ecc8661064443cb5beeecacaa1b9fdb626448778d34440ce5b9fd3b80d0d1d1bb52e2c7631e52066c4390d39997dfe
- SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVZYasau8OXsf3rF:bHuHNgHg1flT/Vk3HYwLfUjYasau89bF
- TLSH T1FE452852DAA44592D6AE0470CF958601B637BD610BD186EB92E4F33E9F323C06EF2717
- MD5 SHA1 SHA512 SSDEEP TLSH