Analysis
- max time kernel
109s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 17:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe
- Size 1.5MB
- Sample260819-vr2q3sel4s
- SHA256 0b350ebf0ebb7a048dedc95ccf272e5cfb73a8c29697887b2126f404f4886952
- MD5 dd0fd4ae1975d7c6b5e59a899463f868
- SHA1 85de3b00573f0955b141ff3f38a8c17147085ec9
- SHA512 617dd8ceb8228567586bb39dd3531835c2149384a06eb22eb0925379464c293d7b839436b8d4d3ee8933a03f5d0b102ddda24588818171cbee785b63089627f4
- SSDEEP 12288:HTX/PI49rNDS5lSi8bP3nCecAwSfxL/2Dc3jDLLmt0LDQewsAjR2q322VVY:HTX/DrNDS5lSi8OMaewsAj6i6
- TLSH T19E6549D3AB56DC72F15C08305565833D513BAE2C0BD34587A2AE3E4E5B343E929F872A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5872 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1720 2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe 5872 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_dd0fd4ae1975d7c6b5e59a899463f868_amadey_darkgate_elex_glassworm_hawkeye_smoke-loader.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1720
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 0b350ebf0ebb7a048dedc95ccf272e5cfb73a8c29697887b2126f404f4886952
- MD5 dd0fd4ae1975d7c6b5e59a899463f868
- SHA1 85de3b00573f0955b141ff3f38a8c17147085ec9
- SHA512 617dd8ceb8228567586bb39dd3531835c2149384a06eb22eb0925379464c293d7b839436b8d4d3ee8933a03f5d0b102ddda24588818171cbee785b63089627f4
- SSDEEP 12288:HTX/PI49rNDS5lSi8bP3nCecAwSfxL/2Dc3jDLLmt0LDQewsAjR2q322VVY:HTX/DrNDS5lSi8OMaewsAj6i6
- TLSH T19E6549D3AB56DC72F15C08305565833D513BAE2C0BD34587A2AE3E4E5B343E929F872A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 85e95f96144701e3a92e7088166cdb83146d527575843a130f1f2c7ef353969e
- MD5 1b96d562a56fb831a245d4aee11133f4
- SHA1 14206c9f6ddad1427ce7aa776a56fb832a3ca5b5
- SHA512 f0bb1873baffc27321465de2227e1245a5c9149af8bf6d1b74dbe185e233737cf3a0babb6046ceb97319976ecb7cd75e63e23150b38ed00a858525db3e300f0d
- SSDEEP 24576:HTX/DrNDS5lSi8OMaewsAj6iy0Le5ji0hmxNrM:LrrNDS5lSxOvlj6iyPji0Aj
- TLSH T1BAA56A93EB65CD31F06984708592833D9433BE180BE3458752AEBF1D6B363E915F8726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 1.5MB
- SHA256 ca8f2c12a84937743c2938c29a1a8bfbea1b9eb04a55cc6149a8b3d9131d3a89
- MD5 0375f7ee1eaedbf8d9190ae8c2277f0c
- SHA1 b6f858954b7229a2bdf6a8a3f5ab7688bc8385d7
- SHA512 4858fcbd3f37f3142c0d9842b57d81e2e16f3e7e399c58d2e6025704eea44c9b3db4acc4dcd5092c4445be92caed3ee2acab8f1569d4dd2863f1341c39a1644e
- SSDEEP 12288:HTX/PI49rNDS5lSi8bP3nCecAwSfxL/2Dc3jDLLmt0LDQewsAjR2q322VV3X:HTX/DrNDS5lSi8OMaewsAj6iRX
- TLSH T1FD7559D3AF56DC72F15C08305565833D513BAE2C0BD34587A2AE3E4A5B343E929F872A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$
- Size 1.5MB
- SHA256 b2ad1de5a45f26233b4a99101a197a705f2e57024527427488c314c28036cd94
- MD5 d430f963af888cf9aea1119d7bdb143a
- SHA1 15d10a5ba7dec11c3c2fbafe740956b687f21334
- SHA512 6122f7ff106aa9d6ea986bbfe81a095b81d989bc39e75b06526f9de676ea830306defcdeb09fbf89db9333632e2203418e0f3a528606ef158923541af4db001a
- SSDEEP 12288:HTX/PI49rNDS5lSi8bP3nCecAwSfxL/2Dc3jDLLmt0LDQewsAjR2q322VVmQ:HTX/DrNDS5lSi8OMaewsAj6iYQ
- TLSH T14D7559D3AF56DC72F15C08305565833D513BAE2C0BD34587A2AE3E4A5B343E929F872A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 25bff948014855a510f4724cf3f214522575956f8a19ca61dccb4cad1fac4a13
- MD5 c8ccbef3f8cbe95d6978ead9dfa2e5e1
- SHA1 ffcf0fb42c282671b99680e7419bb2f5bb4d9991
- SHA512 f6a3aae6bc8bc6c9f2e5c378222dd476d4a056f163bcc069c6a627ed7068ef1ec0943c7c7c8d52bf54cb86cf9d260a80f0a2f3fae9b430e815d6c9b7f389e92a
- SSDEEP 12288:HTX/PI49rNDS5lSi8bP3nCecAwSfxL/2Dc3jDLLmt0LDQewsAjR2q322VVKF:HTX/DrNDS5lSi8OMaewsAj6iwF
- TLSH T1E2754BD3AB56DC72F25C18309955833C503BAF2C0BD3458762AE7F4A9A343E925F871A
- MD5 SHA1 SHA512 SSDEEP TLSH