Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 23:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
- Size 20.0MB
- Sample260415-2772csd13z
- SHA256 dd81788053022c506e78cfdf0e5e6a84b5dc853a54a78dc46de6be55b078d0e1
- MD5 3f7ab83a82b57620d416748f6686df3b
- SHA1 d70ec04fddad1c03809784b5dfb3996a2130b681
- SHA512 b9d14bd1f6a61f300e0853507c43cc5e5a10fa9e5e205857583309fc93497b38d7cfbb93f82f1bbce12384a0eb27106b325b265ede78e2dac8dc4f6ac39e4fca
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIkgTH2qBpu1QfLIqsufCjrOOwH+vG:6wOTKqzBQUTHNBpu1Qfc0CjrOB+O
- TLSH T14727F61562958FACC05FD074CE4665A296237C868F71ABDF1980BF693E766F02E3420F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\help.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\regini.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\more.com- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\UnlockInstall.cmd 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.19041.1_none_b0df27a8cf08799e\LinqWebConfig.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_e190f18a08ed1a44\FlashUtil_ActiveX.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\r\bootim.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchIndexer.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\csc.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVShNotify.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_e6643fd4db9b8479\SystemPropertiesComputerName.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\fc.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15805.0_none_fcd173bc1b434b81\AddInUtil.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\MusNotificationUx.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\r\SpeechModelDownload.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\notepad.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\PrintDialog\PrintDialog.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.84_none_f80970fc24265338\BioEnrollmentHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrmEngine.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\f\MicrosoftEdge.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_a541e711f3b2a478\mobsync.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.19041.1_none_ed965939376efbbf\MigRegDB.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\f\fhmanagew.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.19041.746_none_492c8c53f3547077\r\PerceptionSimulationInput.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\f\backgroundTaskHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\ndadmin.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.19041.1_none_5faf0ebeba197e78\calc.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\wksprt.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\r\wifitask.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.19041.1_none_3b97be772075a03a\RdpSa.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_4eec2752c7ea16f8\f\backgroundTaskHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_a5a5fe7757df26e3\NcsiUwpApp.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\f\SecurityHealthHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.1_none_43a1294286598aee\IcsEntitlementHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\winresume.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\mofcomp.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchIndexer.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\f\DeviceEnroller.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\SysResetErr.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1151_none_0412565dd5f26733\wkspbroker.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_f4898caed6e558be\tzutil.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\WSManHTTPConfig.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.1_none_7c197eeaa6d7861f\SndVol.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1_none_62d38a38e1f19c9f\nfsclnt.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\hh.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\r\fontdrvhost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.789_none_9beee4eb02a5f8c7\Narrator.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\immersivetpmvscmgrsvr.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\f\spaceman.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_9b0dd648f2c31f16\r\dfrgui.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\f\ThumbnailExtractionHost.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\klist.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1_none_84e58cd924a91c8f\wiaacmgr.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\r\pacjsworker.exe- 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_3f7ab83a82b57620d416748f6686df3b_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4084
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 20.5MB
- SHA256 e49dbafb6bd85407569e491390fa8510187b8618780afa0e7c5542f45dfe0f19
- MD5 cbb675012c388751dba4922e90edf307
- SHA1 3f0d7e7f9578b262eda249e08a144441715de8a8
- SHA512 06d87755b08d7045e30710964b46cc1ca277f6e19ec6226272098623662722881536a9e9ee490a76fee860991849421a7a043129384dc34bb59d0a4e0226748c
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIkgTH2qBpu1QfLIqsufCjrOOwH+vcos:6wOTKqzBQUTHNBpu1Qfc0CjrOB+Ls
- TLSH T11127071562958FACC05FD074CE4665A296237C868F70ABDF1980BF693E766F06E3420F
- MD5 SHA1 SHA512 SSDEEP TLSH