Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 10:24
Behavioral task
behavioral1
Sample
2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
- Size 12.3MB
- Sample260815-mfdwwatfre
- SHA256 78ca4e99b97b6415cb27f7b109159645fffc84bda4e4f647ef792a896e33c5b1
- MD5 f217bc51c616f0882b8c90fb737cedc0
- SHA1 eb8ce80e57a55855d6497315c3cafd77a5586545
- SHA512 ba8cc7dc9b0c6f73d6220e73901bac6b77aa2663398534127ddc854933b483617c3b0d471a7dfd80f6671d8e605ba739fefdb3186364704e960ffd05a8880bb0
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo/7IV2VIjozjo0:ShwZi32PVTfYoTIV2VqoXo0
- TLSH T19AD60603AD7CDD2AF87E39B5C894DA749C283D191A237457B9E0BF6EE9321C17618231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x0006000000016b47-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x0006000000016b47-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\certreq.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\format.com 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\at.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe -
resource yara_rule behavioral2/memory/4648-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x0006000000016b47-5.dat upx behavioral2/memory/4648-331-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4648-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_b3595e41e3c0336d\waitfor.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\r\dllhost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\dxdiag.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.26100.1_none_7ec569a17c2e80a6\TpmInit.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmplayer.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\r\PrintBrmEngine.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\WMIC.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15912.0_none_6f42c7c83cc3cb06\SMSvcHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCmdRun.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\DWWIN.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\r\convert.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\splwow64.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\mavinject.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_8e6ef7811b80d32a\RegSvcs.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCopyAccelerator.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseAP.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchProtocolHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_08f23f1b0a87acee\getmac.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ARP.EXE- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\bitsadmin.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\WSManHTTPConfig.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_255c949d766547ab\aspnet_state.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\r\MsSpellCheckingHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1_none_b917a4fda287fde2\diskusage.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\at.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_fd3d350bee0e4f11\bcdboot.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\r\OptionalFeatures.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\sethc.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\AppVDllSurrogate.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1_none_0f32fd2fa8c53bd5\rekeywiz.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_6a91f0bc88e36d4b\Register-CimProvider.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sudo_31bf3856ad364e35_10.0.26100.1_none_a2b1ee1b85e5539a\sudo.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WindowsBackupClient.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_a7d95898a02bb485\aspnet_wp.exe- 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f217bc51c616f0882b8c90fb737cedc0_amadey_darkgate_elex_glassworm_hijackloader_luca-stealer.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4648
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.3MB
- SHA256 18af96f8ef92a773259ab6b5a0984baafa20b5ab424a95e9ce450a2acde79df7
- MD5 b4b51dfc9151572acb56d5850611557b
- SHA1 7e42b482482b73130ac0d17fee506b3b1d67db48
- SHA512 27cf76af9ac8dfefc84fab1b3f1c31438c98c643824bbb7af39e6ed6e922c08130d36d7d7950537f17d4f3eba3261fbb6ce303019d677251dd14d09ac711711a
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo/7IV2VIjozjoNezSC6v2XMHK:ShwZi32PVTfYoTIV2VqoXoqh
- TLSH T130E60603BD7CDE2AF87E39B5C894DA749C283D191A236457B9E0BF5DA9332C17618231
- MD5 SHA1 SHA512 SSDEEP TLSH