Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 02:04
Behavioral task
behavioral1
Sample
2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 12.7MB
- Sample260416-chabcsd15l
- SHA256 0c8527791a3d13e32d5b99b6ca411dd43bbf80b57355aa3492f81f37c24909fa
- MD5 68da4829789e6bb5e3fd1806aa2f794f
- SHA1 81ccdb880c3feb72986b6fbf93814ef4b7ffad55
- SHA512 a2465cd3451f4b4502487baf82e14fd89e34966f4d84a8fe9b9c1dc12aa3d62ef5f13180c43dcc6dabcb2d829164aba5bd757172717dcb1bd1a76f63073bfaa8
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo/U4A:ERXMzdl66YMTA
- TLSH T14CD67D15F2B2217DC22B957880699E37B9303C555B308DBF9188F6742D37AA4993EB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00080000000243e5-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00080000000243e5-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regini.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msra.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systray.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\find.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral1/memory/4188-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00080000000243e5-5.dat upx behavioral1/memory/4188-536-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4188-3204-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{92C4B1EE-A2C2-4A93-966B-B76B164E4A86}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.84_none_027c502c6e331223\r\SppExtComObj.Exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_996ba223b673811b\dsdbutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\upnpcont.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\poqexec.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootux.deployment_31bf3856ad364e35_10.0.19041.746_none_1c0a97992f105d4b\r\bootim.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.19041.1_none_7dca23f8be8c25d6\InspectVhdDialog6.3.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_76011176d90c065b\svchost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\setup16.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.19041.1_none_8c0b126c198fcf70\IMCCPHR.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqsvc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_6f451098bef6266e\WmiApSrv.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\r\mspaint.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizard.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVNice.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\r\WpcTok.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\wecutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmmon32.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\r\runonce.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\r\upnpcont.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\f\RemoteAppLifetimeManager.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\f\hvsievaluator.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_e8a5ac944557b7d6\icacls.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiFileFetcher.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\f\appidtel.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1202_none_958d6588f50ca146\f\edpnotify.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFaultSecure.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1_none_45334ed1c0264cf2\wkspbroker.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\f\setupugc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\WinRTNetMUAHostServer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.19041.1_none_1e01a107b6c5cadf\certreq.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_687f28352b92068b\attrib.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.19041.1_none_857c0c60dec56103\snmptrap.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_1fe438473a878c5c\TapiUnattend.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\DWWIN.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\r\gpscript.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\r\ndadmin.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\f\ReAgentc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_b0feb06b14107c04\wecutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_d16ea4809a87fadb\WPDShextAutoplay.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\f\control.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\FileHistory.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\IESettingSync.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.1_none_4aeccdccebca6ca1\ProximityUxHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.19041.1_none_1102b0871cbfcf0b\rdrleakdiag.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\f\Dism.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.1202_none_024525bdc81df50d\n\VmComputeAgent.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\r\EASPolicyManagerBrokerHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1_none_55c691f63ac916c4\wuapihost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.3MB
- SHA256 a8d3364233db424a33aa0b8bf32464fce482fa61199d96847a32d11719835f94
- MD5 6ed7cf3b74a0347b88f8c6c3ff1abb9b
- SHA1 1430f62bbd90afe5410155873066e4e240624377
- SHA512 6fcdcb6be41f1718adcb4b2daa14fabb86b4780d8aa4b70a4e4d6e0d4fcf4a4fd23767d8e31440f6e84df4bceeb69be7cffc98fae61af58ae4f37655f2112f64
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo/U4tE:ERXMzdl66YMTtE
- TLSH T17CE67D15F2B2217DC22B957880699E37F9303C555B308DBF9188F6742D37AA4993AB33
- MD5 SHA1 SHA512 SSDEEP TLSH