Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 16:29
Behavioral task
behavioral1
Sample
2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
- Size 15.4MB
- Sample260415-tzfcdaf17v
- SHA256 7f8d29c0a04d110d1d1ac4eee0e54f91e8862e2fc6444d44bdd9a822b4abbbc0
- MD5 ac36db3ca60e5f0a6bb4c36e24f29ca9
- SHA1 f9823c65621878e85f362a9c8ea4601bfd921ab1
- SHA512 66390dd6f111c6f207fe54283b6c5fa102a826b3c798facf828d9dc9be14de29843ecf42d0fb5f8c13b2f3ea6f530ea5d253297104021a4b96c6bc1b6f790fe1
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo0THNBpu1Qfc01:ERXMzdl66YJHNBpu1Qfc01
- TLSH T1EBF63A11B1A66BACC11F9434C95AA972A9323C414F205FFF4584FE343E366B46E3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tree.com 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\more.com 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\sort.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe -
resource yara_rule behavioral2/memory/1136-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0008000000000437-5.dat upx behavioral2/memory/1136-368-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1136-3178-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpshell.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\winrm.cmd- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\r\directxdatabaseupdater.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.318_none_47eee9eaf8f3237f\f\ntkrla57.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\f\raserver.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.1_none_f3552e31fa0ca962\WUDFCompanionHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.22000.51_none_b4d2b89d5693dc06\f\la57setup.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_987098e149e09f68\f\msinfo32.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.22000.1_none_1aa5e4c18d034965\nmscrub.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.22000.1_none_88f83cb6aac344cb\icacls.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\f\fixmapi.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_b4bd4664802eaae9\CheckNetIsolation.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\splwow64.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\n\SenseCM.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\chgport.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vdsldr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.282_none_31bc5b70e4490cff\r\vmms.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.22000.1_none_5d8b0964af4f5e05\LockScreenContentServer.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15806.0_none_cd062650b14ec503\ServiceModelReg.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\BioIso.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.22000.1_none_505e5b5dbc1f65d8\manage-bde.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_2c29ad827f986a34\TSTheme.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.22000.132_none_2eb02d05c34e2eef\f\WaaSMedicAgent.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\r\SearchProtocolHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\mfpmp.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.22000.469_none_265cec8f409ba4eb\r\HealthAttestationClientAgent.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.22000.65_none_2d03a3ca59967a09\r\WpcMon.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\r\bdechangepin.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\wsmprovhost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.22000.1_none_6cee8466f2fab8e9\regini.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_2f8cc74dbe756b7f\wiaacmgr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\CapturePicker.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\lpremove.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\MiniSearchHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\WebExperienceHostApp.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_87c7d35a92de7cef\findstr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.SyncController.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\LaunchTM.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\f\SpatialAudioLicenseSrv.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.1_none_0bc8a5933825a63c\certutil.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\f\adamsync.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.469_none_bc884b259290e3bf\DeviceEnroller.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\msra.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\acsr.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\f\SecurityHealthHost.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\securekernella57.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_94e400242f9bfd4a\f\control.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ac36db3ca60e5f0a6bb4c36e24f29ca9_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.9MB
- SHA256 a36f1033e6bb8bb2bb235af0c9f2b142dff2ef1bf129577abafdba350834eb66
- MD5 c842dfb872536a3651a952227e97b438
- SHA1 96fbbea139317fc44d2d9d4624f37d07f9e0a364
- SHA512 023331542e0617af9f806e15750de04e00042e7f1e22d836d7c17433c0492f3385805a7ef031e8344cc8669cdfd08ec6aeb808a175c57864955212b1b9bd7cd9
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo0THNBpu1Qfc0KL:ERXMzdl66YJHNBpu1Qfc0KL
- TLSH T1E6F64A11B1A66BACC11F9434C95AA972A9323C414F209FFF4584FE343E366B45E3972B
- MD5 SHA1 SHA512 SSDEEP TLSH