Analysis
- max time kernel
117s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 18:00
Behavioral task
behavioral1
Sample
2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe
- Size 2.6MB
- Sample260818-wltc7axejg
- SHA256 c377efdf60554fe6c5d81185ec1f7a969166997ce0bcee3ff98b651f1c32ac68
- MD5 4da675be2a1dcce180c70addf1a2eb4b
- SHA1 e20371f81e1570de0c6165f2940fe11ab79d4c48
- SHA512 5ff3ab3e7c32bd765ff4f6e2509e3459d0877735edb6fdbf1d5eb814a16e0b9e67f51acf933ff08ae4cb3522a7b7eafa8047fca07450853213620d9bd8461290
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGLi5jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTO:A3kMFljrpYqLeW4SkZP4sz9Mb8pYq
- TLSH T11BC52A16F6788332D073C0B9C5D2AB9AFA3134455B308ACB5349D76C2E277D29A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2440-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c512-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2440-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1868-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9f-1281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8ba-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f0000000188ac-1526.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c512-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9f-1281.dat aspack_v212_v242 behavioral2/files/0x000200000001b8ba-1339.dat aspack_v212_v242 behavioral2/files/0x001f0000000188ac-1526.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1868 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2440 2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe 1868 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_4da675be2a1dcce180c70addf1a2eb4b_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_hij.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2440
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1868
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 c377efdf60554fe6c5d81185ec1f7a969166997ce0bcee3ff98b651f1c32ac68
- MD5 4da675be2a1dcce180c70addf1a2eb4b
- SHA1 e20371f81e1570de0c6165f2940fe11ab79d4c48
- SHA512 5ff3ab3e7c32bd765ff4f6e2509e3459d0877735edb6fdbf1d5eb814a16e0b9e67f51acf933ff08ae4cb3522a7b7eafa8047fca07450853213620d9bd8461290
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGLi5jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTO:A3kMFljrpYqLeW4SkZP4sz9Mb8pYq
- TLSH T11BC52A16F6788332D073C0B9C5D2AB9AFA3134455B308ACB5349D76C2E277D29A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.1MB
- SHA256 6757f16e6c95650038ecae59fe2e0df8fb2d4be4b8b38184f9bc08c22dc127d5
- MD5 1a97644a4478bddad4383925509b46e1
- SHA1 cd2b99703f8c06cb86a407c4dbb644947abc5ffb
- SHA512 8cfebea2222e76ef6862ad642eabbcf84e55d764726220b6e0605b8fa466eac356bc6e944a70fa6690d917fe8e772415709a6fced41a7ee3ada79707e22e8728
- SSDEEP 49152:A3kMFljrpYqLeW4SkZP4sz9Mb8pYqHTd9CHKyao:A3kM/6YfkZc86YCqo
- TLSH T19CE54B15F6B88372D073C0B9C5D2AA5AFA7234451B308ACB1349D76C2F277D29A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 3693ccb4581559ce56c84e5a878d0538bde43dc43c48af21464f43c74c476db4
- MD5 6d7a66e0f5f162813f2e9045e5fbaae5
- SHA1 884ce891b3f86d5fd67252a3c7ddcc29f412e74a
- SHA512 3551ff27e4cc78604c39ff3edb76504a25a832f6907a3150b4390faa62bd269430607463df374c59ba05de7228d9eadd4542d290b2b590b700466c904e2f21ab
- SSDEEP 49152:A3kMFljrpYqLeW4SkZP4sz9Mb8pYqjPji0Aj:A3kM/6YfkZc86Gjo
- TLSH T185E52A16F6788332D073C0B9C5D2AB9AFA3134455B308ACB5349D76C2E277E6863A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe$
- Size 2.7MB
- SHA256 7cb32d2b9992b7f45af168681024c0002ad509a6397d851dc7c052e5144c00c6
- MD5 b1dd1ca8156bcc3976e7a832e21ed343
- SHA1 da907dfaee609c3c079290eb23b0e088271281ea
- SHA512 03b65175c42bedc4d95dd2acf14881a2cf671b39d4db3721018e71aa493bbd5e48945589d276c283fa718ab771f29876fc56fca04219a151bed7bfe49c63fe5c
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGLi5jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTd:A3kMFljrpYqLeW4SkZP4sz9Mb8pYqqp
- TLSH T181D52A16F6788332D073D0B9C5D2AB5AFA3134454B308ACB5389D76C2E277D29A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.7MB
- SHA256 6aa7e42c12e8af62548fbc88b50db3544e34546657de96e1e66273e656d3bcf4
- MD5 f7dfa7e1db2f68d0acd62ccf3a044285
- SHA1 adfd4525341df517b16b1249d4da6c13e36eafd7
- SHA512 f1b96029ef8d577a0909eff8c08e8f94240b829381a51717f3e3c620f10632bd683512da5023c7f3226e6c65319dc8ee3868a3df170926bbba4ab9ad46349b5e
- SSDEEP 24576:A3mnXoZjzyaEFoeo+aewsAjVGLi5jcAkSYqyExZe0p4Ek4niOkl/A04szE87JKTM:A3kMFljrpYqLeW4SkZP4sz9Mb8pYqt
- TLSH T1E6D51A15F6788332D0B3C0B9C9D6AB5AFA3138450B308ACB5349E7682E377D69636735
- MD5 SHA1 SHA512 SSDEEP TLSH