Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 08:55
Behavioral task
behavioral1
Sample
2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
- Size 11.3MB
- Sample260815-kvsbpssfpe
- SHA256 431704b56a31c464b0a20eb9551f20712c6ebd3d4451d7b21754ea18e3f63fe7
- MD5 cbacd218a5495a033bc27a6f6554cc54
- SHA1 7dce770bd3ca648b919095d1ef840af6e17cbfcc
- SHA512 cf7879ba392bd36f7f8db3c8cde043e93beee0f2a32b4ea328c50a916663e84ae8dc9bdd9f0da9489364e44f9a886572ad02b00c9d6bdbc1301bd4a26dc3289a
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSABd8joZ:ShwZi32PVTf9d2oZ
- TLSH T108C6E503AD7CED6AF97E39B5C858CA749C183D196A637426B9F0BF5EE4321C17608231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000900000001b83c-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000900000001b83c-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fc.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\print.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe -
resource yara_rule behavioral2/memory/924-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000900000001b83c-5.dat upx behavioral2/memory/924-440-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/924-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_a9d07790da9b357f\grpconv.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\r\charmap.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\esimtool.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1_none_60e0d7585c6b83b9\eudcedit.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchIndexer.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\PhotoScreensaver.scr- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_068e99c8dd0d8394\aspnet_wp.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\logoff.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1150_none_5404854ee1749b61\r\shrpubw.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\r\Win32WebViewHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\SyncHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\r\hh.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmdl32.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_651b8bd27b17ef87\where.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_f6e3595e2d1c0bde\XamlViewer_v0300.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiWorker.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\r\lpkinstall.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\sfc.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_4c51727a891ced07\r\credwiz.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_012b81e0c046e57c\wlanext.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\NcsiUwpApp.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\r\vmplatformca.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\splwow64.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\WinRTNetMUAHostServer.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\msfeedssync.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\r\Windows.Media.BackgroundPlayback.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\ldp.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\chcp.com- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\r\ProximityUxHost.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\r\rdpclip.exe- 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_cbacd218a5495a033bc27a6f6554cc54_amadey_darkgate_elex_glassworm_hijackloader_icedid_luca-.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.3MB
- SHA256 eeff6bb8836684c31e2fc5454e86cffb655c407759ca2ed5c8f8dc4cc4ba21d5
- MD5 e68f73ce2dbba15bd5055e7f68683d2a
- SHA1 4f901142704c87755226c59ff7b5af432063c4d4
- SHA512 6e4ad6cfbb4ea1d737b53c522d0965602402af06f9644e8497b8256e6c28e0361a9d5aa5b5ef9f68c316c8a438db4152f9bc7ec3c632975601421e0dd4c0b28c
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSABd8jo2ezSC6v2XMHb:ShwZi32PVTf9d2o1w
- TLSH T1B6D60603BD7CDD2AF87E39B5C898DA749C283D195A237456B9E0BF5EE8321C17618231
- MD5 SHA1 SHA512 SSDEEP TLSH