Analysis
- max time kernel
97s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 09:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe
- Size 2.1MB
- Sample260825-lmmxpazdkh
- SHA256 21981fd407602a977cc302eb70369fcf6a6a99270efcbac834cf3321ad305b0e
- MD5 7cbbed37186eee38688e01ca5de8cd94
- SHA1 c4a2ff1471cf08c13b94556b20d079aa3dc3329b
- SHA512 249f053d51c579c1cfa61847246a072d975045a1061ca4b6bbab008a2162c3aa39716b5c6b560440d8be1dfd8834f4c2ec77d279f2522b36c2fd0b16fdf432a3
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWD:jnTNM84p0mDta468tDZqrKV
- TLSH T107A5CF66EBA4C6F5D2720230C6E7D671F2B6FC51472052CF52A8DA1E2F632E11E39712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4736 2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe 2228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7cbbed37186eee38688e01ca5de8cd94_darkgate_elex_glassworm_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4736
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 21981fd407602a977cc302eb70369fcf6a6a99270efcbac834cf3321ad305b0e
- MD5 7cbbed37186eee38688e01ca5de8cd94
- SHA1 c4a2ff1471cf08c13b94556b20d079aa3dc3329b
- SHA512 249f053d51c579c1cfa61847246a072d975045a1061ca4b6bbab008a2162c3aa39716b5c6b560440d8be1dfd8834f4c2ec77d279f2522b36c2fd0b16fdf432a3
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWD:jnTNM84p0mDta468tDZqrKV
- TLSH T107A5CF66EBA4C6F5D2720230C6E7D671F2B6FC51472052CF52A8DA1E2F632E11E39712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 c301ca6016ca6ff9457a9688803db4acba657d58e31cf0023b40849f0edeffec
- MD5 1c39b678024d80ad231f04e8a4982ca0
- SHA1 7361840477bf77932fd60e25b6a9608d2c717376
- SHA512 e9c76a65953fd0019aedbd98e7fa9b30181d6749c594492c8e3c97715b0d40ed2976ba893da0d1e258efd64c38190a67389e0d354d86ea90678349df3fe7b979
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWL:jnTNM84p0mDta468tDZqrKRPji0Aj
- TLSH T19DD5BF56FBA4C3B1D1738174C6E3D6B5F6B2B841473086CB5298D62D2F632E14E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 2.1MB
- SHA256 403310f01fc159ffd863ae0036e68109a31cdcce1f76cfcac7d0035965262305
- MD5 47d682ad9c853d30376a6d966235018e
- SHA1 e68a848105346ec6e31e66f9fc8a1569442d2ef2
- SHA512 c16906ab2e171010adbc293ffc72cac64c4340b0deae83d5eb1cd93d9e2a373497bceb43888824545579756559b059063c0785d5db8c4e22e5e4261e9cc4da1e
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWq:jnTNM84p0mDta468tDZqrKo
- TLSH T19CA5BF66EFA4C6F5D2720230C6E6D671F2B6FD51472042CF52A8DA1E2F632E11E39712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 2.1MB
- SHA256 a8df615ddbf26607f2cf6c82cc16c095847669b48032a1b5ec068ed785eea406
- MD5 b06daa0bc2a25c8e14ebe108f7910c2a
- SHA1 7db0f852e9ad2383def70fbfbfa7c2a6ee6b1ec0
- SHA512 4d91e97d89128b7cd4e226a03230d9d58db707e5f309602eb86ad2d7ad8239c042dc6096bb68c131e95600e81a5d3da900addf6dee978d796cb47c4877ccecee
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWO:jnTNM84p0mDta468tDZqrKc
- TLSH T194A5BF66EBA4C6F6D2720230C6E7D671F2B6FD51472042CF52A8DA1E2F632E11E35712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.2MB
- SHA256 003bb5cf7e3641ebda9418e699404ba76f8982ea8fe21aafa64b29dc9ead6cd4
- MD5 7448b9648ba0b1aa837d0e15eac00252
- SHA1 2403e712fb44db7cf03a5ec76c98d5c93b4b7291
- SHA512 3b538eb3aebfb30be2af8378ad20b202b4c0b5228eb0898a45e474115e680d55415308a013207ff6a5e6fcfbd5e17bc629e40142466b59739fd21c1d6115a76f
- SSDEEP 24576:K+hp1flT/VM84p0mDtaLg/DRZhf0deU/N9M+ugdM4WC6wK3Mu2E63N+tCn50ChWB:jnTNM84p0mDta468tDZqrKT
- TLSH T11CB5BF56DBE4C6B1D2A21230CAD6C671F2B6FD91472046DB52A8FB1E2F732E01E35712
- MD5 SHA1 SHA512 SSDEEP TLSH