Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 22:52
Behavioral task
behavioral1
Sample
2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 12.9MB
- Sample260415-2tdklabv5j
- SHA256 7376750f9cf42157879de29c7a9be53dcf4af34791022ab5360928af2d602928
- MD5 0ab05eef11cbc899defa3d46189ae170
- SHA1 8cec897a0efa49f0211ebaba10315a0f5d6e9b25
- SHA512 182eef1664b3c8b449e2217f88da07d7876262f9dd45f5e8d84576f96921b638e77c818450eab6b376b4466c2c549884e60bfe203015a067604a88e6d8808b1f
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6YoNXOTz:ERXMzdl66YIqz
- TLSH T190D65B59F2A221BCC22B957881599A33F9303C405B309DBF9188F7742E77AA55D3E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\control.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fc.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\help.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmc.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\calc.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\print.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\format.com 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\write.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/5520-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000c000000027002-5.dat upx behavioral2/memory/5520-662-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5520-3186-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_72d931253b133480\f\msinfo32.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\f\tcblaunch.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\cscript.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_8e52c12ba60f5a2c\wordpad.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\wscript.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\f\refsutil.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.22000.1_none_36e30e5c0bb5efc5\mmgaserver.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.22000.1_none_0ea3b62aa1979b9b\NDKPing.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\r\CustomShellHost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\ScreenClippingHost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.22000.1_none_2e3f0787886879d3\wbemtest.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\f\winrm.cmd- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.22000.1_none_7a72c4e477e7b25d\dmcfghost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.22000.51_none_b4d2b89d5693dc06\la57setup.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\r\PinningConfirmationDialog.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.22000.1_none_87bb487f5d189323\TSWbPrxy.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_98ecfb26dc5bb1d2\wab.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.22000.1_none_ce9abaf7344caba2\regsvr32.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.22000.1_none_2249c58b4a39a50e\DeviceCredentialDeployment.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_c387f681de81f59d\agentactivationruntimestarter.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.22000.1_none_132662a9c55e557b\attrib.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.282_none_a808d085c7f06d67\r\nfsclnt.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\r\hvix64.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.22000.1_none_170791d396c16360\WmsSvc.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\r\printui.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-adminsnapin_31bf3856ad364e35_10.0.22000.1_none_d8155ee7186af991\TpmInit.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\CallingShellApp.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.22000.1_none_c0f347d59a01d496\CasPol.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmdiag.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.22000.1_none_011628217859daa6\w3wp.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\f\vmcompute.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\r\SecurityHealthService.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\msra.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\TpmTool.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_20c655d14680f9cf\f\SearchProtocolHost.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.22000.1_none_63c1e7db07fabcb1\msoobe.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.22000.1_none_ac1383f732e955f2\CExecSvc.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\wowreg32.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\TCPSVCS.EXE- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFaultSecure.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\r\CapturePicker.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslg_31bf3856ad364e35_10.0.22000.1_none_9e234e33bc03ba30\wslg.exe- 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_0ab05eef11cbc899defa3d46189ae170_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.4MB
- SHA256 5fef3fa115d32c17a9be2c49b39ff56247cf92a02e2b4d58afbc41e729c95987
- MD5 a8c7e626eff2a99858ecbc8993861498
- SHA1 381853e05f6f26c9ab987e2ed7ce7b62dec81f3f
- SHA512 778c4eeaa7795074776e0c9d29e408b05dcd804b2710a2e3ce0adb007f6339221d92ebd739cf6adc55813f120cfd427a2d1b4875b14ce8acea7e537748ff1739
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6YoNXOTAr:ERXMzdl66YIqAr
- TLSH T178E65B59F2A621BCC227957881599A33F9303C405B308DFF9188F7782E77AA5593E732
- MD5 SHA1 SHA512 SSDEEP TLSH