018232d32c098f289d5931cd5622793e69ad82f4e11acc3c6cdff29dd98e94cb

Analysis

max time kernel
13s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Size 9.0MB
Sample260912-thg5msec72
SHA256 018232d32c098f289d5931cd5622793e69ad82f4e11acc3c6cdff29dd98e94cb
MD5 e1156f8983666c61dce1cd9e35f6ea80
SHA1 a33e4aaa0285bdf4495f924cce26324cc517c52b
SHA512 13bd17b05946ac93f5c46c8af41bd5103f0e1a35a661277f52e054ad5ee125272146390ed7d2edbdf5cfff1a0f62051be1d8746b2a87e1abe61e6bf38f868e55
SSDEEP 98304:5CUgTH2M2m9UMpu1QfLczqssnKS7TIOSAs3BdHv:5NgTH2qBpu1QfLIqsuf7TfA7Hv
TLSH
T10A96491222D98FADD0AFA438CD2669B556237C568F329FCF28807D293D717A05E3521F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Custom signature

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4d0-4.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c4d3-79.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4d0-4.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
behavioral2/files/0x000d00000001c4d3-79.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Custom signature

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1992-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4d0-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1992-10-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5208-78-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4308-81-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4d3-79.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/248-84-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5080-85-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4d0-4.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4d3-79.dat	aspack_v212_v242

Executes dropped EXE 5 IoCs

pid	Process
5080	MSWDM.EXE
4308	MSWDM.EXE
3488	2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE
5208	MSWDM.EXE
248	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
File opened for modification	C:\Windows\dev5412.tmp	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
File opened for modification	C:\Windows\dev5412.tmp	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4308	MSWDM.EXE
4308	MSWDM.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3488	2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 5080	1992	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe	88
PID 1992 wrote to memory of 4308	1992	2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe	89
PID 4308 wrote to memory of 3488	4308	MSWDM.EXE	90
PID 4308 wrote to memory of 5208	4308	MSWDM.EXE	92

C:\Users\Admin\AppData\Local\Temp\2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev5412.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_e1156f8983666c61dce1cd9e35f6ea80_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3488
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev5412.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5208

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_E1156F8983666C61DCE1CD9E35F6EA80_AKIRA_AMADEY_COBALT-STRIKE_DARKGATE_ELEX_GLASSWORM_HIJAC.EXE
Size 9.0MB
SHA256 55bf006d954bae7f77d105277a4063e52e15edf0e5a4a3414fea9415bacec75c
MD5 5ed20d12292e1c503372455baafc6c7b
SHA1 56cab98118521819a04984059e794128f840422d
SHA512 fe31d856e697577f779dc5c8abb1b301604c1b6c5a927aac5847400b287d6393202b07136de153ca320f7837c0e62b6a89b04b81ef87f7c446044517df3f374d
SSDEEP 98304:5CUgTH2M2m9UMpu1QfLczqssnKS7TIOSAs3BdH0:5NgTH2qBpu1QfLIqsuf7TfA7H0
TLSH
T12496491222D98FADD0AFA438CD2669B556237C568F329FCF28807D293D717A05E3521F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 166KB
SHA256 aa7589969f7ab2d949ca218f543877be72787f62a9de11b840854845a7d93c39
MD5 6b3fd0739c53406c69f7a3c600b85ccb
SHA1 49c7f1170c96090bc60779d291cd4cee5ed8e7cf
SHA512 d719f1e271c35161ac7391b7f5a329a962bf4024c5aafc647666e26d80d3569b88a48dee63e2f68ffbeb16abeb6dcb858a22da30578187369545f334b5e4e9cb
SSDEEP 3072:kT4CJ4QmKk61NmSTBjDT7lVKG+4MztutF4NVxcCXXYAFtPD:9xY8
TLSH
T186F3D44363FC1219F6F37F41AEB852A44B77BDA1AA3EC14D1685115E08F0A90DA72B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 8.1MB
SHA256 38af66cd46274400487cf8454579e1dd2992d7a6bfa44342e3cfaa691445f014
MD5 8604220ce30cbe72896e2c6562118a1e
SHA1 5127f7239976e819002d323463a635743b86241a
SHA512 6532da6a763df8a632d9007e9a632adcdca0093b2b6095b8a4ae120616ec69efdc873297955cdba0e86c6169c471c38166ba11ff0852bbc17f277e28bd3853a5
SSDEEP 98304:5CUgTH2M2m9UMpu1QfLczqssnKS7TIOSAQ:5NgTH2qBpu1QfLIqsuf7TfE
TLSH
T19986381222D98FDDD05FA438CD1629B566237C5A8F229FDF2880BD293E757A05E3520F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev5412.tmp

Path C:\Windows\dev5412.tmp
Size 905KB
SHA256 98d9926152fda45705f5e208d7236e467caeef83d756a14b4104ebf804644b29
MD5 fe821f6fa60e9df9fdee69a23488bbab
SHA1 f6a5c0e05ab0b7ffa81a3637e4a4110458a38e1d
SHA512 22ffc710b73460f13a94d8ce9cdd1d455043610776972cc953d301b67a7b91465719d86ffcaa72c3ee85c30baa5c0abca364943ea1bcc87b097c4abd39bdc519
SSDEEP 6144:1G6lX2ih9UB9jxbu/l8wOUsn1yy5//+9ljrVQxWc4Jg1LozBFnI8f4rCE8shqppY:kBGEtx0l874jrIWXg1MzBFnI8UChNXWH
TLSH
T10315090277F98179F1F37B71AEB992645A77BCB09D35C10E26D1225E09B0A90DA32733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-84-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1992-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1992-10-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4308-81-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5080-85-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5208-78-0x0000000000400000-0x0000000000414000-memory.dmp

Download