Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/04/2026, 13:37
Behavioral task
behavioral1
Sample
2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
- Size 11.2MB
- Sample260415-qw72faas41
- SHA256 765dcd4e5e6cbb7f12e4e7184dc437f572b2c3554d6ca8fde849db3cabba254c
- MD5 2587bf01450066006e8829b6e0d4fd74
- SHA1 baf8eacfc676cdbfb1c3c07ebe19cdd64f692b7d
- SHA512 5e6f9d07c0387437e427a9720cd6475fd4c25017db63bb6ba5e0db3cf6a58ff7302e3e66e09b46835f2d617e920937a59e0f0f15d7382e06d254d7224283b88d
- SSDEEP 98304:Hx1bDE9F8N8f01iuciNu2zPnj/7pxXo1PTJxjRXzkTIOSAT/PvOAjcXvvOOc5R:TbDE92NwnYBzzXo1LdzkTfHHOAoXvvOZ
- TLSH T1F2C68D1EBBD44876E1BB42394972561DD275FC228B32828F31546B1E5EB2FC28E36713
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001100000001d8b6-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001100000001d8b6-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\where.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\printui.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mode.com 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\printui.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\more.com 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\charmap.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\expand.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\reg.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\sort.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\tree.com 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe -
resource yara_rule behavioral1/memory/4296-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x001100000001d8b6-5.dat upx behavioral1/memory/4296-493-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4296-3224-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\GetInstall.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\identity_helper.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\notepad.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\r\SysResetErr.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.19041.1_none_4c7da197e5837576\dtdump.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingSvc.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\AuditShD.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9c79736d61efaf52\imecfmui.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\wscadminui.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\changepk.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\f\LicensingUI.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\PrintBrm.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\r\UNPUXHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\poqexec.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.1_none_8ade03f009f66b38\InputSwitchToastHandler.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\reset.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.84_none_f80970fc24265338\BioEnrollmentHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\r\mmgaserver.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\f\cttunesvr.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_2ace380757b108f3\provlaunch.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.84_none_65d0f4a4c6cd4975\Magnify.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\r\MDMAppInstaller.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\prevhost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_ad0ed54dd130eec3\DismHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.19041.1_none_ddb8055b31c2ae64\proquota.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\TokenBrokerCookies.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.19041.1_none_b78e3fadb804b45a\SystemPropertiesAdvanced.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.19041.1266_none_b5fa73367bbd2f91\f\klist.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.746_none_9d44fd61d4c8aeec\SecurityHealthSystray.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiWorker.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.19041.1_none_76edadec5ba257b3\verifier.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.CscUnpinTool.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.1_none_4c44763647728882\RuntimeBroker.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\mode.com- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\CHXSmartScreen.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\lpkinstall.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmplayer.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1_none_eb29661c32e6a63a\rdpsign.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_4005191f803b56e1\isoburn.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpresult.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\FXSUNATD.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\r\HvsiSettingsWorker.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\wmprph.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\f\auditpol.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchFilterHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_1ec972de354a6d3f\diskpart.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\f\PhotoScreensaver.scr- 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_2587bf01450066006e8829b6e0d4fd74_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.7MB
- SHA256 7f4d9cdba8d89f5c2561b198240be9ac95b4e447673b40e1f6fa0802e5ff1ebc
- MD5 4fb03328850705419aa2f1407c63b2e2
- SHA1 4f985fddba0f8b99a9f4bf099d11bc4459fb9c02
- SHA512 52c67165d7052501a72287a78d2687b46acae770e55eba99851e7d6148807baf2eb4944e0fc1e9b2080c7b37788d379123f7a2ec9114f376393353a1b0c1b42f
- SSDEEP 196608:TbDE92NwnYBzzXo1LdzkTfHHOAoXvvOJoo:T3c2NwszLyLdzQ/OTdo
- TLSH T142C68D1EBBD44476E1B742398972561DE275BC228B32828F31546B1E5EB3FC28E36713
- MD5 SHA1 SHA512 SSDEEP TLSH