Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 14:07
Behavioral task
behavioral1
Sample
2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
- Size 11.3MB
- Sample260415-re6bysbs3x
- SHA256 75d2b1eac1b0222926a571961aa81695ffb8c852e84478d36a0f5e6892850e66
- MD5 38d25d31d65d9513732392c224b47c8f
- SHA1 d8dab424d048ca9c4945735e11e6f65d8fd0ee9a
- SHA512 7fc9cd58f42e9298199633dd0660e4173c143c7a717d1f246703cfee38cc95cbe1befe96d55119947240abff97964e2b1605159651a6b39e1b838bc9ff559127
- SSDEEP 49152:JxpM84pkc8MNFvgA0vbGAIiIrdGUIVBXdc6+/PivcpfQvdaKYXf3CUeyjc4t2vL5:OfkchgAOSJdTQdM/PvOAjcXvvOOc5Q
- TLSH T115C6900FAA2CDD66F56E3DB48C44C6E49A287C844662346739F4BF5EDB736C12E19230
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\user.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\regini.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\print.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\format.com- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe -
resource yara_rule behavioral2/memory/3056-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000900000002a117-5.dat upx behavioral2/memory/3056-518-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3056-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\f\TpmTool.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\lsass.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_aa4efcf84be1b89b\r\CheckNetIsolation.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\SearchIndexer.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\bfsvc.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.22000.1_none_b2bfe436fa0c3b50\CCG.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.469_none_59f2db2aeb94e019\f\WpcTok.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.22000.1_none_31882142e0963c64\WinRTNetMUAHostServer.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_6a1935736c898073\PresentationHost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\UsoClient.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrs.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_ddb5359fa07e69e6\subst.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\ARP.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.22000.1_none_6f96a08b64cc0ef2\msdtc.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\f\fontdrvhost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15806.0_none_74bbba9b266e4967\AddInProcess.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.22000.1_none_b15540a9822b5c00\rdrleakdiag.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\r\runas.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\r\rdpshell.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.22000.1_none_a192cd380c242ff3\SystemPropertiesHardware.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVDllSurrogate.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\f\LaunchTM.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\CustomInstallExec.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.1_none_1788ef5112142c1f\DeviceEnroller.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\ie4ushowIE.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.22000.348_none_53ff6ed560767984\f\mighost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.22000.120_none_c4a02f7c0324c157\SearchApp.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\r\VSSVC.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\r\hvax64.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\r\adamsync.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\f\msra.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15806.0_none_9d9bd2a20503beca\aspnet_compiler.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.22000.1_none_c4795c793bc04b9f\hvsiproxyapp.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_4294863d020c9d21\tcmsetup.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.22000.1_none_86f921f526968cd7\RegSvcs.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\f\slui.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\UtcDecoderHost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\SearchHost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_2e5256cb5b543e55\Windows.WARP.JITService.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\f\SpeechRuntime.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_6c7a140d3670631f\winrshost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.22000.1_none_4a402141287803ba\mtstocom.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\r\wuauclt.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\r\wmpshare.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\r\wowreg32.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\r\SpeechModelDownload.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\TCPSVCS.EXE- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.22000.1_none_bd5081933d30392a\RemoteAppLifetimeManager.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\f\CustomShellHost.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\f\WerFault.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_38378aefc68a365f\autochk.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgport.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_160f000044fc4872\WmiPrvSE.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\winload.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.22000.1_none_c660e47e5b7af804\cliconfg.exe- 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_38d25d31d65d9513732392c224b47c8f_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.8MB
- SHA256 9c149108d668e021d6ca71ed80c48ec22eda8bd0fecd745ac214eb4444934246
- MD5 179a9778d08b9bb72c00a2139e0a458c
- SHA1 bc7436a071ee706b699fdc16f3c734cd4dc34b15
- SHA512 ec717be20c0e69f90f26a2625b03fd2b88c827ee0946e4a7838ae71e6dbadc4e8e255796fa360adabf195aca3755f23336c157b0d37a9890343d264946123a76
- SSDEEP 98304:OfkchgAOSJdTQdM/PvOAjcXvvOOc5IjoN:Sk0JdMdqHOAoXvvOCoN
- TLSH T106C6A30FAA2CDD66F52E7CB48C44C6E499287C844662346739F4BF5EDB736C16E29230
- MD5 SHA1 SHA512 SSDEEP TLSH