Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 02:04
Behavioral task
behavioral1
Sample
2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 12.7MB
- Sample260416-chabcsd15l
- SHA256 0c8527791a3d13e32d5b99b6ca411dd43bbf80b57355aa3492f81f37c24909fa
- MD5 68da4829789e6bb5e3fd1806aa2f794f
- SHA1 81ccdb880c3feb72986b6fbf93814ef4b7ffad55
- SHA512 a2465cd3451f4b4502487baf82e14fd89e34966f4d84a8fe9b9c1dc12aa3d62ef5f13180c43dcc6dabcb2d829164aba5bd757172717dcb1bd1a76f63073bfaa8
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo/U4A:ERXMzdl66YMTA
- TLSH T14CD67D15F2B2217DC22B957880699E37B9303C555B308DBF9188F6742D37AA4993EB33
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1ad-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1ad-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\comp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\find.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\more.com- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net1.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PING.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\secinit.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\user.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\print.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wusa.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/2084-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001d00000002b1ad-5.dat upx behavioral2/memory/2084-666-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2084-3198-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.22000.1_none_c0a088f7530491ea\browserexport.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\f\FileExplorer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.22000.1_none_a115c50e5daa7435\scrcons.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6bd596e0ba043609\imjpuexc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\ARP.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\TCPSVCS.EXE- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_4902a165a673e741\f\mstsc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.22000.1_none_02ba73751dd9765e\setx.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.22000.1_none_11dd22030027b61b\sigverif.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\TextInputHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\r\vmcompute.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.22000.1_none_661d9c5c6a1c32d3\rasautou.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\TSMKUFIL.CMD- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.22000.1_none_65f380faa4e1a1c3\PhotoScreensaver.scr- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.22000.493_none_674ce99b39869941\f\ntoskrnl.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_product-containeros__windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_2b1b00237ae1bbca\f\SearchIndexer.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.22000.65_none_4f258ec343f09686\oobeldr.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.22000.1_none_bad94eac3141fbc7\bdeunlock.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\r\SpeechModelDownload.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_8289edcdf2ad65a4\cvtres.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.469_none_4b2e9fd5814459a0\r\winload.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\r\wevtutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_97c4601a91ef2a4b\f\mfpmp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.22000.1_none_ed19a89f248a8665\psp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\TextInputHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-proquota_31bf3856ad364e35_10.0.22000.1_none_885f3fcfcb8efd54\proquota.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\f\wscript.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\AppVStreamingUX.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.22000.120_none_0b04aa9dcb2db938\f\CredDialogHost.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\r\printui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\LicensingUI.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.22000.1_none_45984ec0fd57e0f5\systeminfo.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.22000.1_none_cb20c829bd1c95e8\provlaunch.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.469_none_4ee2cfd406c59bc7\f\omadmclient.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.22000.65_none_8e80131135014fd5\dusmtask.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\r\LockApp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\r\LaunchWinApp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.22000.1_none_8f68fe9bc09029b2\prproc.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.348_none_04e0603a0d245e07\r\ie4uinit.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\IESettingSync.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\AddSuggestedFoldersToLibraryDialog.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\f\SpatialAudioLicenseSrv.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_c78a68497548f374\r\fsutil.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15806.0_none_14b35d27c5caee09\ServiceModelReg.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\FXSCOVER.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.22000.1_none_7f29d071eb745e94\MdRes.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.22000.1_none_3ccc038fc75b3c47\imecfmui.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_bfb8876999af625a\cmstp.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.22000.1_none_25e44d77231e4b64\AtBroker.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.22000.1_none_f7ed7304d1a0058b\WMIC.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_9f38aa7663fcbf45\r\control.exe- 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_68da4829789e6bb5e3fd1806aa2f794f_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2084
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.3MB
- SHA256 a8d3364233db424a33aa0b8bf32464fce482fa61199d96847a32d11719835f94
- MD5 6ed7cf3b74a0347b88f8c6c3ff1abb9b
- SHA1 1430f62bbd90afe5410155873066e4e240624377
- SHA512 6fcdcb6be41f1718adcb4b2daa14fabb86b4780d8aa4b70a4e4d6e0d4fcf4a4fd23767d8e31440f6e84df4bceeb69be7cffc98fae61af58ae4f37655f2112f64
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2IgX6Yo/U4tE:ERXMzdl66YMTtE
- TLSH T17CE67D15F2B2217DC22B957880699E37F9303C555B308DBF9188F6742D37AA4993AB33
- MD5 SHA1 SHA512 SSDEEP TLSH