2586c016aad0239c6ac837544ad949363976dc4623f4ea7d393b8b3f5e2c08a9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/09/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Size 986KB
Sample260913-m5cecawckd
SHA256 2586c016aad0239c6ac837544ad949363976dc4623f4ea7d393b8b3f5e2c08a9
MD5 b92693dde0fc5c07208cfa8b2979aed1
SHA1 444cf2bf592e735b0ddcf21d59e1ec1825ca4079
SHA512 502af603302b2769af0030cb24a59140e906f9238187fd6a8856efbcbc329b945329d42756462b33860f50e4a7e83bd9f2066937cd736fe2aad6187cf572cbfb
SSDEEP 12288:uvwkNKiZ+RrGGNUbTNwcrwkNKiZ+RrGGNUbTNwc8AwSfxL/2Dc3jDLLmt0LDQewW:szNKUNwUzNKUNwGaewsAjG
TLSH
T1A5254936EE38ECF2C67F4CB95B61C701AA3579204B5192C7D2B8829DCE132D05E79E16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6008	temp0a1.exe

Executes dropped EXE 5 IoCs

pid	Process
6008	temp0a1.exe
5900	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
5276	videoNet.exe
916	temp0a1.exe
4404	videoNet.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jaremore = "C:\\Windows\\videoNet.exe"	temp0a1.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	temp0a1.exe
File opened (read-only)	\??\B:	temp0a1.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\temp0a1.exe	videoNet.exe
File opened for modification	C:\Windows\file0a0.dat	videoNet.exe
File opened for modification	C:\Windows\videoNet.exe	temp0a1.exe
File created	C:\Windows\temp0a1.exe	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
File opened for modification	C:\Windows\file0a0.dat	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
File opened for modification	C:\Windows\videoNet.exe	temp0a1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	videoNet.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp0a1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4204	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
4204	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
5276	videoNet.exe
5276	videoNet.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4204 wrote to memory of 6008	4204	2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe	88
PID 6008 wrote to memory of 5900	6008	temp0a1.exe	89
PID 5276 wrote to memory of 916	5276	videoNet.exe	93
PID 916 wrote to memory of 4404	916	temp0a1.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4204
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Users\Admin\AppData\Local\Temp\2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
    3⤵
    - Executes dropped EXE
    PID:5900

C:\Windows\videoNet.exe
C:\Windows\videoNet.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5276
- C:\Windows\temp0a1.exe
  "C:\Windows\temp0a1.exe" ejecuta
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Windows\videoNet.exe
    C:\Windows\videoNet.exe
    3⤵
    - Executes dropped EXE
    PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_b92693dde0fc5c07208cfa8b2979aed1_amadey_cobalt-strike_darkgate_elex_glassworm_hawkeye_smoke-loader_vidar.exe
Size 54KB
SHA256 a6324117d0f5b16d0ecaccd1497f471495e4b3d315f1df0da66758d0bbab18af
MD5 9ca726be24244f2cf7e2dec95b714c46
SHA1 db976e979ec442e03799a26e861dc21847afe79a
SHA512 8e44e93e4cafba0cb6d3ad2d5f5935f5961cef0c841e534865f9f74f15f5d9007c6d304a597b97641d7cc001a1ef4675b4d19775ea7f4b9a778a882f3deeb449
SSDEEP 768:+E+BqKFkszYUzf2JdmwdAsCeHvJ5YFvqix3DZzmg06juYoX:+FUgCEHixUPig1juYoX
TLSH
T1E6436C06A7B840E6D12B42B0C9A29A0BFE75F552171196CF0BB9C2162F637D0DF3A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 153B
SHA256 0d7bad32c6c60101b68c601725935d56395cfe8eaea78a1b4a17199af39de597
MD5 e0eb302a545930ae854564fa3a284e17
SHA1 64a4564d8513f22d2efdb8f9634f3c892f301a60
SHA512 8f430f06610d2ddc11dbefdecf6796efe632a1b6b1a2873b80c04e6feb08735fd1035055d9209f77648a0efec4515b05f4c7cd7d830e58d5fe266111f1ba108c
TLSH
T13EC08C1284ABCE022066E05A83A35988C090354F634A2320B704800D02EA90FAAA129A
MD5 SHA1 SHA512 TLSH

Submit Download

file0a0.dat

Path C:\Windows\file0a0.dat
Size 23B
SHA256 a39bfb8e0d5f5575038a9dc27672e30212d2dca974b3079bd976df8178e6c6a6
MD5 a36556d0215703dc70c087e7d0855dcd
SHA1 30c0e270334f21a5b3b08dafd6120309bb028d3a
SHA512 78de7d5afadfcb6ba8d849b99d83734c289e7f4487b9d16d35e7c7086ad96f5464b2fb2b2a8bb4839adfc2e91894a52423152ceb1b4edb4676a3e7bfaffa9030
MD5 SHA1 SHA512

Submit Download

temp0a1.exe

Path C:\Windows\temp0a1.exe
Size 986KB
SHA256 2586c016aad0239c6ac837544ad949363976dc4623f4ea7d393b8b3f5e2c08a9
MD5 b92693dde0fc5c07208cfa8b2979aed1
SHA1 444cf2bf592e735b0ddcf21d59e1ec1825ca4079
SHA512 502af603302b2769af0030cb24a59140e906f9238187fd6a8856efbcbc329b945329d42756462b33860f50e4a7e83bd9f2066937cd736fe2aad6187cf572cbfb
SSDEEP 12288:uvwkNKiZ+RrGGNUbTNwcrwkNKiZ+RrGGNUbTNwc8AwSfxL/2Dc3jDLLmt0LDQewW:szNKUNwUzNKUNwGaewsAjG
TLSH
T1A5254936EE38ECF2C67F4CB95B61C701AA3579204B5192C7D2B8829DCE132D05E79E16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

videoNet.exe

Path C:\Windows\videoNet.exe
Size 931KB
SHA256 86310d8e3cc62a263546b2ecd3899963127c98eb440c8d5f0de4ec159506daa2
MD5 64ff9b6a01eb413fa404a12e72bc53ad
SHA1 cddadb34ef6a043f413a0382ab539b11f524bc99
SHA512 2d5e39b4c19ce40efc80aff4f03bc81d08619330ca185c02694bfd4baf8600996af50abe909d37cb7e904a45bddc3732c1e02d2a9e0a8e8abcb55549ef921d09
SSDEEP 12288:LwkNKiZ+RrGGNUbTNwcrwkNKiZ+RrGGNUbTNwc8AwSfxL/2Dc3jDLLmt0LDQewsR:LzNKUNwUzNKUNwGaewsAjG
TLSH
T16B153876EE38ECE2C67F4CB95B61C700963979304B5192C7E2B4829DCE132E06E79D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

videoNet.exe

Path C:\Windows\videoNet.exe
Size 260KB
SHA256 5f3ac320f6262749c10b0ab4c8f17f228573bd2d19ba598efdc2defe1397ec87
MD5 b8c2662506edbce24ea549c8b7b006cf
SHA1 0bf7112291c429ab3b6ca5c4c71fd14ee20462b3
SHA512 aef62444e718d6c9d063bb01db08ba215dd309a2cbbbb4a829f6d6cf47af7be846cea76ac3f248daca52af7144de18a7df1aac12e3dd9ce5dc1d202b8cfc542c
SSDEEP 6144:MIuADRpc9x+mKMLZbitRPhtXWGNU6ITLxiEwgdy1:MwkNKiZ+RrGGNUbTNwck
TLSH
T1C044E57BDD28ECE1C67E9CB89B91C700977275314752A3CBD2B4825ACE032E09E79D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-20-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4204-2-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5276-14-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/6008-11-0x0000000000400000-0x0000000000413000-memory.dmp

Download