Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 09:46
Behavioral task
behavioral1
Sample
2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 14.1MB
- Sample260415-lrmsgsd17t
- SHA256 754c3cfdf0c5e39a02b20c2080f84178193a8674086c23d4c9169175da9f4da9
- MD5 ea8f163fb5db0dd50ad7e9f51acf1e1a
- SHA1 ece2a2581859d158a7994341743fe06300d3f9b9
- SHA512 05bd2584427554eb5100d6216761c8b02d0234a7a39f1c9c75ba6dc8eae5a5fcb759d6a408d16c5df0d69eb6a2f4616b6577b32218b81252467714b1f0817836
- SSDEEP 98304:OfkchgAOSJdTjfkZcg/PvOAjcXvvOOc5yTIOSAU:Sk0JdHP2HOAoXvvO6TfI
- TLSH T197E6F50F6A7CDD22F17E3DB9C850C6A89A287C944622745738F4BF5EDA732C16E19231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000c00000002ad99-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000c00000002ad99-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\print.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\makecab.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hh.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\secinit.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/3172-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000c00000002ad99-5.dat upx behavioral2/memory/3172-548-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3172-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CA565693-D2C5-4BF5-BC9E-F82435F8187A}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\r\SpeechModelDownload.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\f\AppVDllSurrogate.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.22000.1_none_418429ddc6d1eb8f\logagent.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\ROUTE.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\LaunchWinApp.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.493_none_7918a9fd73257276\LaunchWinApp.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchIndexer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\f\MDMAgent.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\r\LsaIso.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.22000.1_none_11400bad816266c9\dcomcnfg.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.22000.1_none_25e44d77231e4b64\AtBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_570a42293a25658a\fc.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\IESettingSync.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\r\audit.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_037bca9e287fff5c\quickassist.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\f\winrm.cmd- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_bdd6ed7a5949f71c\r\FilePicker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.22000.1_none_094f49d32c4abf9f\UPPrinterInstaller.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_bb381a0becef4d51\certutil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.22000.120_none_4a072e86b7c9806c\r\Microsoft.AsyncTextService.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\r\SearchIndexer.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.22000.1_none_397d6ed60254bd95\PackagedCWALauncher.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\f\fontdrvhost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\Robocopy.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.22000.1_none_544784bd2f04ca1d\SensorDataService.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.22000.1_none_cdb916a4abddbb05\OpenWith.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.22000.1_none_76531c94f831c76b\runonce.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_2fcf8aa3ca0a349d\esentutl.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.22000.1_none_2c8e6409d7552dca\mmgaserver.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_49da5498936ff387\CertEnrollCtrl.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_a92436e98f43ccd7\tree.com- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_c4e0220059a427b2\CredentialUIBroker.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_c26272ecb066f6ab\f\ByteCodeGenerator.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.22000.1_none_b9b90ea0c63699c2\RdpSaProxy.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrs.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.22000.1_none_a115c50e5daa7435\scrcons.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.22000.1_none_65f380faa4e1a1c3\PhotoScreensaver.scr- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tpm-diagnostics_31bf3856ad364e35_10.0.22000.469_none_3fa2439425626f6e\f\TpmDiagnostics.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\r\wevtutil.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.22000.65_none_cf76e66c2463ea3d\convertvhd.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\f\runas.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wabmig.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_16fdfdd9b45d6e53\waitfor.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\f\TrustedInstaller.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.22000.1_none_c3646c52777cf90a\OpenWith.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.22000.1_none_f1c351dedf09f213\AddInProcess.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15806.0_none_a79116553d9d1dc3\ilasm.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\f\CheckNetIsolation.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.22000.318_none_64b09e1111e8c6f6\f\winresume.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandboxClient.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.22000.1_none_7ccc80588ec2a649\format.com- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\ROUTE.EXE- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6200919c299287d9\AppLaunch.exe- 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ea8f163fb5db0dd50ad7e9f51acf1e1a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 01ca8bf61e2c4054687a0cf4d099612d18805f926cfe6620bb2d3aa7b4120217
- MD5 cd7d91a71613e32bbaf12556fd11e87b
- SHA1 ca4abfb8163823169e20379df7e6df6a6e8de00f
- SHA512 e0c9846ba2cefc277f0ad73cb39f19e75f8495c15977c34af29a8811c8d676855719e885d95926b78e2df294354b1a557d6c027d6a58b4c04f3afa2e631243cd
- SSDEEP 98304:OfkchgAOSJdTjfkZcg/PvOAjcXvvOOc5yTIOSA0joJ:Sk0JdHP2HOAoXvvO6TfyoJ
- TLSH T1EFF6060F6A7CDD22F13E3DB9C890C6A89A287C544622745739F4BF5EDA732C16E19231
- MD5 SHA1 SHA512 SSDEEP TLSH