Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 06:42
Behavioral task
behavioral1
Sample
2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
- Size 16.6MB
- Sample260416-hgtlhact21
- SHA256 9b1e0236d247e981a4b6138543d5053b4eaaa3dc9de9bcf3ebdb8b03a75de291
- MD5 4b2d5cf8e5668ffc6956b7569ff0ec5c
- SHA1 aed7f45905a44bd524b6e939e4bd4eb7d0d5ff5e
- SHA512 1bb307fe299192a4a836dfd94e76cca01e8294ed061e358e882bcce5a6930ba715e392436e2e7930d3f649e504db23003827f6f3a8bc640c7775411fdba937e6
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YofjrOB+4z:ERXMzdlT/d6YKPOB+4z
- TLSH T165074A10B2A26BACC11FD474C55AA972A9323C454F309FFB4584FE343E366B45A3972B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\timeout.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\format.com- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\notepad.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\curl.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tree.com- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\chcp.com- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe -
resource yara_rule behavioral1/memory/4320-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000b000000024226-5.dat upx behavioral1/memory/4320-424-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4320-3200-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\logagent.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.1081_none_e3f87355251e8c43\notepad.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\relog.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiWorker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\r\fixmapi.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winload.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.1_none_0423901f2a62a812\FileHistory.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acsr.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.1_none_b19798c3028c2929\LockAppHost.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\ShapeCollector.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ARP.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.19041.1_none_7275aff6509d3c66\IMJPSET.EXE- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\immersivetpmvscmgrsvr.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1237_none_665f7346099d6350\r\bdechangepin.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\query.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_9fa94241ef63ceb4\f\wermgr.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\f\AxInstUI.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.1_none_224ac1aa56b7c6c2\CIDiag.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_4005191f803b56e1\isoburn.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_684a86f0f0d0d27d\mountvol.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.19041.746_none_6275453e12708a76\r\recdisc.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\MoUsoCoreWorker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\wininit.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_f3a9dc0fe254a157\wmpshare.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\r\AxInstUI.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\f\powershell.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\f\refsutil.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_64d33f8fb364398c\r\net1.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_4b1a1978d1832a5f\f\OpenWith.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupcl_31bf3856ad364e35_10.0.19041.1_none_0ea013578aa5744f\setupcl.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\Microsoft.Uev.SyncController.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\r\UndockedDevKit.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_c719fa2e662738e0\WPDShextAutoplay.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_fa9e6f40748daf14\colorcpl.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.1_none_39d7f735c58f975e\UserOOBEBroker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\rdpclip.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\r\wslconfig.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chglogon.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\r\MoUsoCoreWorker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UpdateNotificationMgr.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\TextInputHost.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\f\mspaint.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.19041.746_none_c82b4b805b9ae361\SystemSettingsBroker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_937e52b9922bd791\certutil.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.19041.1_none_d570c31a162768ba\RemotePosWorker.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_0f8992295edbadb4\eudcedit.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\f\TokenBrokerCookies.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_0d475c3f57a2ce2b\at.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\autoconv.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\f\MuiUnattend.exe- 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_4b2d5cf8e5668ffc6956b7569ff0ec5c_akira_amadey_cobalt-strike_darkgate_elex_hijackloader_ic.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 17.2MB
- SHA256 d81428f3012ac31c9281d51317e9803ca1b435bb370eaebe024d329560427e31
- MD5 ca5dc94772b7814bd0452c3e9b8941c1
- SHA1 7ee2fcc0874204ebe5508c00ba8f8082d934ca1a
- SHA512 bc99880b15280de5ebe36722ef16d2aaf56b0a833e959c6331c4056f44c88ecf8e1824b0cd67f1546e39709c20ca0a283c9080b6de04f03a2417f2b980945267
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YofjrOB+4Aa:ERXMzdlT/d6YKPOB+4Aa
- TLSH T14B074A11B2A25BACC11FD474C55AA9B2A9323C414F309FFB4584FE343E366B45A3972B
- MD5 SHA1 SHA512 SSDEEP TLSH