ac81cac40df8b194e1399b4bb4c9f9e26f13650d2d6630f1f1deaf6485524c7e

Analysis

max time kernel
92s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Size 1.5MB
Sample260818-vm5beaxyfw
SHA256 ac81cac40df8b194e1399b4bb4c9f9e26f13650d2d6630f1f1deaf6485524c7e
MD5 aa9ec9bfe112d03218847981f57e672d
SHA1 4d399c9fd88909304e9024090d52f502635f3cc3
SHA512 16e3aa83b4c5d84a4a36aa9a55c301dd9496b0cd87572250ae778dfec7e9c0562c3b45be3f6ee147388d519049761a7aef5cf44e471cfd71c4976ca6608c7b46
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrM:A3kM8ljMPji0Aj
TLSH
T18A758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 12 IoCs

resource	yara_rule
behavioral2/memory/1236-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c57e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1236-165-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2244-226-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bb69-312.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb5d-304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-426.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-424.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019977-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a00000001889d-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00080000000064cb-1997.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c57e-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001bb69-312.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb5d-304.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-426.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-424.dat	aspack_v212_v242
behavioral2/files/0x0003000000019977-576.dat	aspack_v212_v242
behavioral2/files/0x000a00000001889d-1402.dat	aspack_v212_v242
behavioral2/files/0x00080000000064cb-1997.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2244	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1236	2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
2244	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_aa9ec9bfe112d03218847981f57e672d_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1236

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.5MB
SHA256 ac81cac40df8b194e1399b4bb4c9f9e26f13650d2d6630f1f1deaf6485524c7e
MD5 aa9ec9bfe112d03218847981f57e672d
SHA1 4d399c9fd88909304e9024090d52f502635f3cc3
SHA512 16e3aa83b4c5d84a4a36aa9a55c301dd9496b0cd87572250ae778dfec7e9c0562c3b45be3f6ee147388d519049761a7aef5cf44e471cfd71c4976ca6608c7b46
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrM:A3kM8ljMPji0Aj
TLSH
T18A758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WCChromeNativeMessagingHost.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$
Size 1.6MB
SHA256 8e39a46831834cef856c6b7d9cadb2b2dd26db8b1046681162a4aff7b0215c67
MD5 18058368c3432a86487c94e3b2fa72a7
SHA1 f4f7a1984130ffed70ad9fcaff4ba10f73dca92d
SHA512 ba7614ecd2ae8dcb5b8afa19bfb7b97d28c6463f732ff013772500ade8c04ac8fc74092d1cdd69b31b3dd8141b933e7089381325d5515c79c239024e2ba45b20
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMzzgfy:A3kM8ljMPji0AjGwy
TLSH
T1A3858D22F6B48271D077C075C9E2975AEA7178510B308ACB9398D76D2F337D19A3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.0MB
SHA256 41ea25644aa8e95c5fdb422867f9ed9a9e4c0ab2c9b857b858beb53159edc3f2
MD5 31899ff3ba2cea561b7e304f994c365b
SHA1 424065c4fb4e432a2b65935cef7fedc1b88c3fff
SHA512 84bba1d6bda439f4d00e1352bdb6dfda29687856316751b4b3a7610f960279edd7902c6758427f474cde06e99ed4084c9855f10c929ca286e4f4cb628f0e3dd6
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3kM8ljMPji0AjKPji0Aj
TLSH
T158A56C26F6748375D077C0B9C5E2A75AEA7134420B308ACB5395C76C2F277E29A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 da7b5a912e64447b0bf963f0bbfbf5e649b6ded0a1b257b134826618c5842642
MD5 2b7861ff7fb64c091a4b469cb756d753
SHA1 1bf846d4722cbaf65390bd13dc22519e442e7427
SHA512 2d8db273612aab6ea0ed15d4579c84bd24d87b7fc22ad56bdf28f1cf2fd800c5fb623aefaf403bea88ec4429c4439a11e3cd23b855960a1095014e8d69007c23
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMbC:A3kM8ljMPji0AjB
TLSH
T127758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 1.5MB
SHA256 9502930886cbb222a12d80ef87151828ef280f565e95b74dfbea7ffc44969f17
MD5 a7daba5a7b29c9196376ce1a5d23f135
SHA1 63a99b6007c46fa1b4fdc70cdaa2182d5a198b28
SHA512 7a001970bd9e855bb25e171f7bafd918fcb41d06ae192c4e6d3099c55171d77cdead0e2c8f31e585ebf08ee489d1ebdc5ed18ff6e068b2e4a228e1ff477dd7b8
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMkw:A3kM8ljMPji0AjM
TLSH
T12C758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 1.5MB
SHA256 2be811e8062cae9d120ff1ef6ccd4d53ba181b980fb64ce383215ba36a853beb
MD5 ef5b9fef1f38d6e4bee3970af44b5443
SHA1 2621051a874626f88be48374166ea7e023463831
SHA512 f1608aa357801e1229146678b7bb545439b902db92aad1ee9654ebc66c48d6ca7d18ef3301c295be9035d192787a915373282091f0af6fdd141e625e369e4bfd
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMQo:A3kM8ljMPji0Ajk
TLSH
T1D3758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe$

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$
Size 1.5MB
SHA256 928ca7806ca4c79cdda5d2aa47a6c06449c3390c3c7dccb137ab1edb684ac103
MD5 53cc315202ff1bbb523ae84a00d6cc76
SHA1 997d2143c54708f2e630374947fc192fda9e3d61
SHA512 ff86f9e7a2edf2801ce5d3ef758e4958b0e2c5d3913b24ea2eb535f37e7f086f4d9379c720bde9a1d80e6707012ed6b5116ff3f0fadacef90669db4dbf8a66d8
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMSI:A3kM8ljMPji0AjW
TLSH
T12B758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 1.5MB
SHA256 5d5d6304e6e131ba6b43d0199d3294cb7b9242e1d54361481f99ad6045fe00a9
MD5 f8da4f9f734561dad94cfc4b0e329ba4
SHA1 21c72afadd5db6c345892784bbc5b0a083d77f15
SHA512 cd5d871ddd2afbdb97ca327df906edd697fbbd2006e32ef5eac94f809cde11ee1d137bb180d50461ee3f88eb424f85f3ac9608a51f2b61fe4eae454d909ad493
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMwQ:A3kM8ljMPji0Aj0
TLSH
T1B6758D22FA748275D177C475CAE2975AEA7138510B308ACB9398C76C2F237D19B3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe$

Path C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe$
Size 1.9MB
SHA256 efdb4bcad7dc238dc50b032dbc1f6cad52ddc8a4aff3d2e45c4a113b4ec7802f
MD5 131a8b621b4b3d43b94f964243e6ca8f
SHA1 bd74144f9131cf8b6790183be4fdfac9a26e21dd
SHA512 8d95d5a3cf0126f00fac07b10ca0c3563eeb90195872ef59531e650c21b668353379bd76c5c094d22d35631a8e33ae04f4772d4a8de76c78698439022cb422fb
SSDEEP 24576:A3mnXoZjzyaEFoHaewsAjYaEpHaiNaoDHZ0Le5ji0hmxNrMFMYenGJiKEbXWtpOG:A3kM8ljMPji0AjPPnRWt4G
TLSH
T192959E22F6B48172D17380B6C5A6D756FE3574510B3089CB9394CB2D2F366D2AB3B722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1236-165-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2244-226-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads