Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 16:03
Behavioral task
behavioral1
Sample
2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.2MB
- Sample260415-thl4lac13p
- SHA256 b6878d1fa8691d538a2716901708f263c9ca5a36ff0e9f1d8d20d5136b992e3d
- MD5 9c9db9193b1fc071bcb8b5771f98fed7
- SHA1 99d0fd4cc3def911d5f3a650918d3b762c20966d
- SHA512 35689bea05c3676e84e2ba4b744c2f7517938fd656046e30dea7b017a923613a7e4eaa0b48def16af5ef8958796fadeea38dced6d9fb681ee9e039a1bfe21f9c
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tbd+WHOAoXvvOqgTH2qBpu1QfLIqsuf0:ERXMzXdyZ/K0ttOTqTHNBpu1Qfc00
- TLSH T10EF64A16E2994AD8C05FD078CA46A561E6337C418F20ABCF5994BF293E776F05F3831A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\psr.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1580-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000700000000d3e8-5.dat upx behavioral2/memory/1580-467-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1580-3194-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zG.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.318_none_2da4853532607174\f\AuditShD.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.469_none_0defc0f5807dd5f0\f\ShellAppRuntime.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\ScreenClippingHost.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_9f38aa7663fcbf45\r\control.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.22000.1_none_58a0c8778f3217ee\lodctr.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_8e52c12ba60f5a2c\wordpad.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\f\sdbinst.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.22000.376_none_836023902a7c3e20\f\bcdedit.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6180ec8e85a3740e\imjpuexc.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\f\adamsync.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\f\spoolsv.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\systemreset.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\r\rdpsign.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\ScreenClippingHost.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\TextInputHost.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\f\tar.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.22000.1_none_1b78a2bc0a780f77\DFDWiz.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.22000.1_none_a4046dd80a1bed7d\RelPost.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\r\repadmin.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_d3608b4d6c1da7eb\mode.com- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\AuditShD.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_75821ac4f6866a77\r\WerFaultSecure.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.22000.1_none_a192cd380c242ff3\SystemPropertiesHardware.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.22000.71_none_974c497c92a1fd89\fhmanagew.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.22000.1_none_aca0f57960f0ae3d\srdelayed.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_26a3fe1b7073b18d\r\sfc.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\memtest.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.22000.1_none_08742a15552b44fb\clip.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3a6786958001450b\wowreg32.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.434_none_2ca09768f8a7e2e6\f\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\r\vfpctrl.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.469_none_8c502cfed26c810b\r\TrustedInstaller.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15806.256_none_cc5e7e903d46eb5d\ngentask.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.22000.1_none_5c143d9b7acb165f\ExtExport.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_aef18f12e09924ba\aspnet_regiis.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.22000.120_none_2f2bb6f2a85481f2\pcalua.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.22000.1_none_c387d4076254e4a3\cleanmgr.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.22000.51_none_2158495b1874d95c\f\services.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\wscript.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.22000.1_none_53e9c4cb2f33e8c8\systray.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\qappsrv.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15806.0_none_74bbba9b266e4967\AddInProcess.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\f\ntoskrnl.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\f\Microsoft.AAD.BrokerPlugin.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.22000.100_none_bac6834bfb16b20d\r\SecurityHealthSystray.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.22000.348_none_160f000044fc4872\WmiPrvSE.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_3353a48da9fe01a4\AssignedAccessLockApp.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\r\msinfo32.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\r\sdchange.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\raserver.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\f\PkgMgr.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.22000.41_none_705d08ab0a6355da\f\mspaint.exe- 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9c9db9193b1fc071bcb8b5771f98fed7_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1580
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.8MB
- SHA256 351e380611a6a00adced984256ec28ac2900607d89c984c104fd05e38002d336
- MD5 f8f609099cf260327a7c4ffa127a5c4e
- SHA1 916f05b3c49d8fb66e5dd327f517e0989c610db1
- SHA512 90e65f1dfd900ad6b4aff929f3d5926941c4f920b814571bfd5c71defce77f98efd301b36e95159e2676a4d5224e276b4638cad6892d672be3993eff9dcc586e
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tbd+WHOAoXvvOqgTH2qBpu1QfLIqsufeoi:ERXMzXdyZ/K0ttOTqTHNBpu1Qfc0Zi
- TLSH T155F64A1AE2984AD8C05FD078CA46A565E6337C414F30ABCF5994BF293E776F05E3831A
- MD5 SHA1 SHA512 SSDEEP TLSH