Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/04/2026, 16:15
Behavioral task
behavioral1
Sample
2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 14.8MB
- Sample260417-tqa2ascw7p
- SHA256 78bb10ffeaa1b79f13ff2a5a74ff8e3fb0b83f1c93a0de14383e55c291ae8f41
- MD5 a7c199c355e58c5f709d0bd41ddca87a
- SHA1 3091516c46091953372f17ce92f311870bdd0a11
- SHA512 10f3d49c3800604b9ecc2556937b4416d9586b1326801b1496e40d9f79481157035a877ae19294e9f84ca52a2da93c75567cf157996259a43c7991e6714ba16a
- SSDEEP 196608:ZaHxXME6o966HtIto0A/WyZ/K0ttYVAATqTfrHdT:ERXMzn6YoeyZ/K0ttYZTOB
- TLSH T1B6F67E12F2B6207DD21B953881298E33BA303C155BB19DFF6544F6B41D36AE46A3E732
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x002600000002b15b-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x002600000002b15b-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\where.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\write.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1128-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x002600000002b15b-5.dat upx behavioral2/memory/1128-510-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1128-3182-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\ProtectUnblock.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.22000.1_none_5c873ec32677d78e\setupugc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.22000.1_none_44d220827fc06fc2\dialer.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_baa7a7b212bbc28d\ttdinject.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\poqexec.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_b0e36fb9b88e8b56\r\certutil.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\r\wmpconfig.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\r\msinfo32.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_b5e493e3fca1e5c2\netsh.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.22000.1_none_fd692349212c38d0\upfc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.22000.1_none_1be9c0745b95a762\MpCopyAccelerator.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.22000.1_none_dbfb4f42942ac176\IMESEARCH.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.318_none_a3d287795cb1ca0f\f\IESettingSync.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\r\FsIso.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.22000.1_none_2c8e6409d7552dca\mmgaserver.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\r\TpmTool.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.22000.282_none_345ca27cf9ce36c0\f\MusNotifyIcon.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\f\SIHClient.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\CustomInstallExec.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.282_none_6b2d7072c225a87c\r\WerFaultSecure.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.22000.1_none_eb18e02f1096ae08\SystemPropertiesRemote.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_576e8243334ab082\f\explorer.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchFilterHost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.22000.1_none_aba17b366eb3e321\drvinst.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_25381cfb8a14a984\wiaacmgr.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.1_none_161d4fe56c866837\certutil.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\f\ShellExperienceHost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.22000.1_none_13aef8973870f6ff\ofdeploy.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\logman.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_c4fc5204471c8488\ttdinject.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15806.0_none_0607cd955dab15ad\MSBuild.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.22000.1_none_fda4ea8a1051069a\dpnsvr.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\f\directxdatabaseupdater.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.318_none_569ec118f1c50925\f\winload.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4374dc8b76e3bd2c\IMJPUEX.EXE- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.469_none_4ee2cfd406c59bc7\r\omadmclient.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\r\ldp.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_bb5ad6287475565d\gpscript.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\DataStoreCacheDumpTool.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.CscUnpinTool.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\Spectrum.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\r\AppVDllSurrogate.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.22000.1_none_0c0c8e31403fe0c1\omadmprc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.22000.1_none_4d8c257de90f7f54\SystemPropertiesAdvanced.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\CustomShellHost.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.22000.1_none_b939484ef91552eb\xcopy.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.132_none_7958838972f5ba04\LaunchWinApp.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\Taskmgr.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.22000.318_none_8b633995ac1a50de\dsamain.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_c35886f1ae4523bc\EaseOfAccessDialog.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\TiFileFetcher.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.22000.318_none_2cba3682f8941339\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_0a56493353e5cd68\calc.exe- 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_a7c199c355e58c5f709d0bd41ddca87a_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.3MB
- SHA256 25d1d0855c20cd0731758b231cdbf744cc0a67d766d568aa8b103fd410b69d1c
- MD5 405e0beb7f0ae9c5159a26c81b161737
- SHA1 42944115905738b161ed69085786198a329848ae
- SHA512 29940dc9ed729f1e336a030b84c60f8f0a5b8ccad296e30642e16e968a26ddfc20ac3ccb7227a0453881af67f395bca242db48ad20e8cb81a8d2506bc8197edb
- SSDEEP 196608:ZaHxXME6o966HtIto0A/WyZ/K0ttYVAATqTfrHdfo6:ERXMzn6YoeyZ/K0ttYZTO+6
- TLSH T12FF67E12F2B2217DD21B953881298A33BA303C155B719DFF6548F6B41D37AE46A3E732
- MD5 SHA1 SHA512 SSDEEP TLSH