Analysis
- max time kernel
96s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/08/2026, 10:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe
- Size 4.9MB
- Sample260825-mc3e3agr21
- SHA256 9f3ca3dd1114cae76e0474f98bd8ed8d3eafac35c834e55dab8e8d567a7c0b07
- MD5 744e44098e9a3dae7b694154c6811f47
- SHA1 fe556440470f057a191c744db039101aa624a3fe
- SHA512 c09e37f8f97c9da3d56e215cdcc72eeb1105317c40af552c68853ccbc173989a2e225700d627e4ee7aa66f0a270cf39ba461488f60063b93b42bfb5acd0baf2a
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFV:JH57txgD53uvU4
- TLSH T12A363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4240 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2556 2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe 4240 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_744e44098e9a3dae7b694154c6811f47_amadey_cobalt-strike_darkgate_elex_glassworm_rhadamanthy.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2556
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 9f3ca3dd1114cae76e0474f98bd8ed8d3eafac35c834e55dab8e8d567a7c0b07
- MD5 744e44098e9a3dae7b694154c6811f47
- SHA1 fe556440470f057a191c744db039101aa624a3fe
- SHA512 c09e37f8f97c9da3d56e215cdcc72eeb1105317c40af552c68853ccbc173989a2e225700d627e4ee7aa66f0a270cf39ba461488f60063b93b42bfb5acd0baf2a
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFV:JH57txgD53uvU4
- TLSH T12A363A81B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.3MB
- SHA256 36fcf511f567a76a705bb43934bd29fcb0bd0cf78ad5fe707b115484e373b150
- MD5 5fb8088c88ed609f7ad3d813a0b9f3a8
- SHA1 900f13aa84171ec99a5f8740767d0f1d2c8a6adf
- SHA512 b256269293345552b94fbdc9d60735e88f88c4cf9e8bec82a29ee1199a63adac7b7c6cc35e37d27dc51a798ba3b51e8b3fac535f2dc9c1f078658033b9dae1fc
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DF9Cqo:JH57txgD53uvUxqo
- TLSH T127465B81B6DB9127DCB611708F7C865075623ED00AB5F14BF2D07A2EDB3A194AD2E723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.4MB
- SHA256 cfd65520a998dbbccf4510c0df0dfec2605f48f5b32f200d4299b5f3dde1da18
- MD5 fa385967266773861d32523a8bcdfd21
- SHA1 c2825983bc9371b9986cc96e2d6de35b82ce2d47
- SHA512 ffd525dee60542d9e26c567274b8b3a0b0b29b972b07a3e855d51c7fbab075f7d52834a17b252ae0949c937b67254e8d14e01b3fb6ec5207587a06a53b56b521
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFBjo:JH57txgD53uvU4o
- TLSH T1D8464A81F6EB9227D8B61170CF78865075613ED00BB5E14BF2907B6DDB3B194A92E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 4.9MB
- SHA256 7cc40312402febb428b9104840aa0ab88fc14f3cb622befdb0b2c3a4a3188805
- MD5 b2fbdff5f6aefadf9d0a938ab28ce29b
- SHA1 c5267f567decd76ec2970b06d0e5e3eda33d044b
- SHA512 e3f2706897713030e842cda2dc11ed1cfc371fe08292ef97fa4b540c0bd6764f44dbece65dc670185194a530a2b3133d84a8c1835f0d5f53a8307e3cc6b93d63
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DFT:JH57txgD53uvUw
- TLSH T1D6363981B6DB9227DCB521708F7C865031617FE00AB5F15BF2907B6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 4.9MB
- SHA256 0cb13cf3b93f3a2ff192b45de75100a2a7ab5cff486c63a5a597a716746a743b
- MD5 36aa93d02cd682615241fb9b1fc6d386
- SHA1 4b2866b40ed3b1319d9bd43760c777a4553e148e
- SHA512 d84fe38d432416f4ace6b761e1040b88b8b454b17700c7c8a2915edd4740ec3430509de51c6931f2e64e057a23298bb4f907d6589e24c71c58137bfaf2b8f60c
- SSDEEP 98304:JzwsAGfzak7tx9zc9IW1dXgfC/MHmg6rOO53Ahv7St8DF:JH57txgD53uvU
- TLSH T1BB363981B6DB9227DCB521708F7C865035613FE00AB5F15BF2D07A6EDB3A194A91E323
- MD5 SHA1 SHA512 SSDEEP TLSH