Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/04/2026, 16:13
Behavioral task
behavioral1
Sample
2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 18.4MB
- Sample260422-tpem4abs3k
- SHA256 5ba64e5bda82ff7411ec098dafe56d97c0f0bc80977fb72c6ca1b658b0e88af9
- MD5 2b5277ac6671e81443417e47d52cb07f
- SHA1 cbe5a0e86e4480e1bc9370ebf06742f12e17ca9a
- SHA512 d19853ee8200c8004798781455119ecb2019519b05f934582005544fbf1ecc71a1b1a7178e98c50ba54a0c26e991d98b7e5efd689430e460978dac4e283d5adf
- SSDEEP 98304:esgGqnstLEHyVPKAtwtYExmNMubxQfkZc3evoirV0t/iLwHft8vAPdh:iGqnhjMrbxOPYjrOOwH+vYdh
- TLSH T155170A017D7CCEDEE85E98308889973999613C085E314ACBF5427F9DF9375A2E93027A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\user.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\control.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\curl.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tree.com- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\expand.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\user.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\secinit.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/552-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00080000000004ec-5.dat upx behavioral1/memory/552-361-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/552-3213-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.19041.1_none_339537d6c993f72b\AgentService.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.1_none_6bb9fe0edad453cc\omadmprc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\f\AppVClient.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.19041.1_none_6e5126083c2c0ea6\NDKPing.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\ARP.EXE- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\f\netiougc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_be3404fb0dff5d84\r\TSTheme.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\f\wbengine.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.1_none_18b14c7d1478d4cc\sethc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\WmsSvc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.19041.1_none_239932b75896a716\ieUnatt.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.1_none_21bf8c5bf7d38604\PhotoScreensaver.scr- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chglogon.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\f\TrustedInstaller.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\CustomInstallExec.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\immersivetpmvscmgrsvr.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.1_none_c564589414ffc535\mmc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.1_none_09dd65fa3d1bcf14\PktMon.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchProtocolHost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.19041.1_none_d908336e5b82be3e\chkntfs.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_220320d2c4216035\TiFileFetcher.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\ScriptRunner.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_e6643fd4db9b8479\SystemPropertiesComputerName.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.264_none_64b3f487e354744d\f\MoUsoCoreWorker.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.19041.1_none_5d169326bbc0abdb\upfc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\r\psr.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.19041.1_none_de17915d5c62b62d\mqtgsvc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\SensorDataService.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UpdateNotificationMgr.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\prevhost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.1_none_cc694aafc259f133\sihost.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\scp.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_41668bdd85c44640\InetMgr6.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.1_none_47f8a965309a7ee6\CloudNotifications.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_6c428bc03bd6600a\winver.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_1fe6ae13cb971ac8\netsh.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\explorer.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\r\InputSwitchToastHandler.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\diskperf.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\f\rasautou.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\f\dsdbutil.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\f\sethc.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\InputPersonalization.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.19041.1_none_b42ad8618bda36bd\TpmTool.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_4b25f9be389a3a63\agentactivationruntimestarter.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_b55c875ed22d28bb\RMActivate_ssp_isv.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\rmttpmvscmgrsvr.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\ResetEngine.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\f\msinfo32.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\r\nltest.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\ssh.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\f\rrinstaller.exe- 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_2b5277ac6671e81443417e47d52cb07f_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 19.0MB
- SHA256 15d7f67c455288a06fff9ffa5d62391450d95e4f22409b60f03ea2e6d784ea66
- MD5 7332a30f91c5ebc4867c7dedfb2a2352
- SHA1 145eb09bf506a34952f8f85d8f347d07d8e27118
- SHA512 65aa9c24acef80587c4254a66c7e95cf20f33721af39d1abf09a7348e638ceaf274ee0d6a9a7cf216e1874c1f726548227371ea8a00536387d97c6c199dca49b
- SSDEEP 98304:esgGqnstLEHyVPKAtwtYExmNMubxQfkZc3evoirV0t/iLwHft8vAPdVjot:iGqnhjMrbxOPYjrOOwH+vYdhot
- TLSH T1EE170A017D7CCEDEE85E983088899739D9613C085E314ACBF5427F9DF9375A2A93027A
- MD5 SHA1 SHA512 SSDEEP TLSH