Analysis
- max time kernel
119s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 11:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe
- Size 5.0MB
- Sample260817-ndvx2syfld
- SHA256 37ee2e1c684d33d98e5331732ab60df60c5d288fb4c485d3136c92329f8acf72
- MD5 38c96563c755348e434863d7645ed165
- SHA1 2ab0001758857b5c28de75b4266694c1a1f1161a
- SHA512 ff12b0389a785f8292954f976524119f74212d4a5536184ba02f739d13d6f4b72499d7c2e232eb3abac07ab685faccc07f25b9c167448271e5f46bf5a73c92ff
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWb:smAE96Co4
- TLSH T141366B12F7E48232E0B3857588A7A756AA31BC511F3187CF1394B76D5E337D1AA32722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/1368-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4f6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb5d-153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019971-545.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8cc-1013.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1368-1152-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2100-1189-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cc8-1256.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2100 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1368 2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe 2100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_38c96563c755348e434863d7645ed165_amadey_cloudeye_darkgate_elex_glassworm_hawkeye_manuscry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 5.0MB
- SHA256 37ee2e1c684d33d98e5331732ab60df60c5d288fb4c485d3136c92329f8acf72
- MD5 38c96563c755348e434863d7645ed165
- SHA1 2ab0001758857b5c28de75b4266694c1a1f1161a
- SHA512 ff12b0389a785f8292954f976524119f74212d4a5536184ba02f739d13d6f4b72499d7c2e232eb3abac07ab685faccc07f25b9c167448271e5f46bf5a73c92ff
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWb:smAE96Co4
- TLSH T141366B12F7E48232E0B3857588A7A756AA31BC511F3187CF1394B76D5E337D1AA32722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.5MB
- SHA256 499e4ed7ed2f9062566f35b141b672355f91b2d2a88b185ef8aab17424e8dcc4
- MD5 c78c37b543acbb7a2a0d4aba4ab0c1c7
- SHA1 5fc16bfb5be24a30719a356d4054ef14c76fea94
- SHA512 533f738e09ca572fc045d84a7cb669443d7b7cb599002a59d6f81991e6d9de14d73446b2a02a6896205082166196db44e4721bc3159f24ef9d6b790f6f94e457
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWE:smAE96Co4o
- TLSH T1DC465B12F7E48232D0B38575C8A7A75AEA717C411B3186CB1394B76C6E337D1AA36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe$
- Size 5.1MB
- SHA256 b677f4bf77d0f16a9596f0f4091876d7e590878135ffcbcf3d3f7fae6939e5a4
- MD5 dcd999e0424640b3b95291ecd9ac90e9
- SHA1 2457750d05efc6797f809ad5203d14837200f853
- SHA512 e06641fa8201435b5e5bca341bc6be54a96f0ee5641ef36d3e3386aadcbb7a8a451569bbbd813ca7130b59322cf5deae345d309465a73574b461be110270f9e4
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWA:smAE96Cod
- TLSH T1C8465A02F7E48172D0BB8535CAA7A756AA327C511B6187CB1394B67D1F337C0AA72723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 5.0MB
- SHA256 5b66b20471854a73c8c0c0dbe5dee1cd2fc424c59a554453493c7f66b73d4038
- MD5 6d3e57649952e58d88829ee511e54aa3
- SHA1 3b2290b1efbadd5ac9a3cfa3c5731f816d448c1e
- SHA512 f2639e2cf2c3fb0931a5c41c762cb30c5986ef2b545d9d0ec0f327ddd95970df39eed21b1d1cd16df5f93fafa6d8abcae4c3946f68297759ae3ca0c117c11c70
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWd:smAE96CoI
- TLSH T1BE366A12F7E48272E0B3857588A7A756AA31BC511F3187CF1394B76D5E337D0AA32722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 5.0MB
- SHA256 6b28df20bd7cd4ccef6fc5ad069fb00b57416b4cc6c495e8cf4bb295143cafb4
- MD5 86e22766e0d7f2b70f091fde171b914b
- SHA1 14bf3ec92b26c37e8621f339caca273420ab9933
- SHA512 f53dd0b0e44123d91c79d8a9a5002be320a307ff9a23ebca91a98917c55972bd5ffbdeeadae13701a68c27b4af9c887134260b9cc39dcf0b64edcdf876f17c95
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWA:smAE96Col
- TLSH T1DC366B12F7E48272E0B3857588A7A756AA31BC511F3187CF1394B76D5E337D0AA32722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 5.0MB
- SHA256 b67474003ec1ffd49ab5f040f38642556de75c5450e32ca2c07ad00066e966fe
- MD5 cb16ec827ea3908d6d40f3e65f209037
- SHA1 1b6a3333ab649fee8ebddd6e0734881c827cd8f5
- SHA512 f32b3f4f8910fafcac81eebc2c4d151a8ebee44e6a746af595dfc6b19aff571f92756bbe3536dcbf515935668152d9a23ab08b6874adfb67e65685d3be3a729a
- SSDEEP 98304:l+RYNAKvkTgXuquveY+W2o8oT3ezMrl9cekcHhXh9HJUiWUXsmqsqzl87aW7tPWZ:smAE96Cow
- TLSH T16F366B12F7E48272D0B3853588A7A756AA31BC511F318BCF1394B76D5E337D1AA32722
- MD5 SHA1 SHA512 SSDEEP TLSH