Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 08:42
Behavioral task
behavioral1
Sample
2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
- Size 12.9MB
- Sample260815-kl49xaeh32
- SHA256 4a38361582d268cda4b49e7141901415c91a194a7adfef76fdedc587607bd4f5
- MD5 f9d392a0008aca73f8c283ca1536eef8
- SHA1 66db36119295615fb7427a839040e1c82800db80
- SHA512 fb9284ab339f251390677de312b37ddd03e1567c38aa017241ebe047859c3527060679fb2220c27dd61d33a22438ab1a9989856a406dc295aca9913c64fa1cc0
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jovMQXdWjo6:ShwZi32PVTfYovMedgo6
- TLSH T1A1D60603AE7CDD6AF87E39B5C854CA749C283D191A237516B9E0BF5EE9335C17A08231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001300000001c3e1-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001300000001c3e1-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\finger.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe -
resource yara_rule behavioral2/memory/1140-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001300000001c3e1-5.dat upx behavioral2/memory/1140-374-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1140-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_70acf1931a9fbc01\r\InputSwitchToastHandler.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\msinfo32.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\r\SndVol.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_a0b44bf0476b30ed\control.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\r\ThumbnailExtractionHost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\NetCfgNotifyObjectHost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.26100.1742_none_b6069a8cd10e9cfa\sppsvc.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WindowsBackupClient.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1_none_5449f71c20d1e235\at.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\SndVol.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\Windows.WARP.JITService.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\esimtool.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\bcdedit.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\wpr.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\RemoteAppLifetimeManager.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\mavinject.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1150_none_b5750378d5419664\fltMC.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\r\esimtool.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\Setup.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1150_none_24e2f2e0c4c87239\r\wimserv.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.26100.1591_none_b519370a5498ebc4\r\dsregcmd.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_f419bf716fbd61e7\aspnet_regsql.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_a2d78d0e147c4763\aspnet_regsql.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\UUS\amd64\WaaSMedicAgent.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiWorker.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmmon32.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCLNWZ.EXE- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\la57setup.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f9d392a0008aca73f8c283ca1536eef8_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.9MB
- SHA256 b5c70cfd8ae2dab7d9918c43d53c6e12614fe8c5cef11f7355835a0eb9c2d545
- MD5 cbad65abb631da3404fb18cda16bd37c
- SHA1 35506bfe835856c3bbccf7d7dc908c08df8111b8
- SHA512 c9784706a85e876a22d35ac975b419b6fc402994927983c512d16a2e367f13c43f791b497e4fafbd9fe2e5428efc04c8fc4972a6f60a0fcb6c8cebbb66a98aae
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jovMQXdWjobezSC6v2XMHr:ShwZi32PVTfYovMedgo40
- TLSH T119E61703BE7CDE2AF87E39B5C894DA749C283C191A23655779E0BF5EA9331C17918231
- MD5 SHA1 SHA512 SSDEEP TLSH