Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
23/04/2026, 18:07
Behavioral task
behavioral1
Sample
2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 13.0MB
- Sample260423-wqe2cset8t
- SHA256 936add3f3f66c914688838ff43c045b0e8f20701f598a571eeea0911364fdeab
- MD5 da1e796302cd88aad24b6e13c1481dc4
- SHA1 0347d7e1649f5b593d2571bbebd453595b481e02
- SHA512 2da3279a85eaf373855645fa488962f87e1c1441b6a38220d3fb08c080d5371daa9d2132b2d22c6e84caa5080e4e11f573732d1654364da56bec47f176ec5830
- SSDEEP 98304:1bD0+Cga+JdXN0B7+siUbYZfgs0QlxejoYevoirV0t/iLwHft8vA7:1bDsj0U64sIo/jrOOwH+vK
- TLSH T1A8D6171166D48FE9C06FD070C95265B69633BC868E319FCF1980BE2D3E766A05E3522F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\verclsid.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\print.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\attrib.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mode.com 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\proquota.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\user.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/3240-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001d00000002b22a-5.dat upx behavioral2/memory/3240-570-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3240-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\r\SearchProtocolHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.22000.41_none_6fef9dc502cda133\r\IcsEntitlementHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.22000.120_none_898d9e6ac325eeaf\AccountsControlHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\SearchHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6744583bcc1cfbb4\aspnet_regiis.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\msra.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_a6af4a93eb065fad\RMActivate.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.22000.282_none_e0bcdfd0611d6514\r\WindowsSandboxClient.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\replace.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\quickassist.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\LsaIso.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\logman.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\conhost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_2ba66e4a445cef6c\eventcreate.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.22000.1_none_032efb965d531126\ftp.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tionsimulationinput_31bf3856ad364e35_10.0.22000.120_none_6698726619b2ab7a\f\PerceptionSimulationInput.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\f\RecoveryDrive.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\poqexec.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\TpmTool.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\f\rdpsign.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\r\pcaui.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.22000.1_none_7317f7d3d7e53645\adaminstall.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_6b5eb3c4c1ffcde9\f\WerFault.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\f\rdpsign.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\WebExperienceHostApp.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.22000.1_none_7aa4e433ee022a53\mcbuilder.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.22000.1_none_035a1d00a9e1b6ab\cipher.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.22000.1_none_75c3533c7b92f5af\RemotePosWorker.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.22000.1_none_bcaa97eff2780373\OptionalFeatures.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\f\SIHClient.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.22000.1_none_e7968f70baa52389\ServiceModelReg.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\SearchIndexer.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.22000.1_none_ae92c24e0a04e0bb\cacls.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\r\TokenBrokerCookies.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\r\winlogon.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-findstr_31bf3856ad364e35_10.0.22000.1_none_87c7d35a92de7cef\findstr.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\RMActivate_isv.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.1_none_1788ef5112142c1f\DeviceEnroller.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.469_none_bc884b259290e3bf\r\DeviceEnroller.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.22000.1_none_a3f177b107b8418a\dmclient.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\r\rdpsign.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\InputPersonalization.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\WebExperienceHostApp.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\SpeechModelDownload.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\f\CustomInstallExec.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.282_none_fbdbe8fb711d9878\f\vfpctrl.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.22000.1_none_d5126d2e75032b40\EASPolicyManagerBrokerHost.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\f\LaunchWinApp.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseCE.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.282_none_88ab4ca49843f4b5\f\VmComputeAgent.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\f\nvspinfo.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.22000.1_none_e08d858702e7237a\Eap3Host.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.282_none_8beb92a45fb95e13\DataStoreCacheDumpTool.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\r\wkspbroker.exe- 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_da1e796302cd88aad24b6e13c1481dc4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3240
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.6MB
- SHA256 08c720a092278d639192214e068b53aab6cd0f8bee6b762437066909f9fb2708
- MD5 e49072b6597a0e3ee57e7ea53b6abb39
- SHA1 c87c3e7d9ff20a4e20948394ddc4691de99dae93
- SHA512 2361325395f98be70b0e68f08fd88816a4c053ada7d238050f932887f5de3713c459c021e8783cccf14d0a1fbe6e8497ca34e2d0cf16c3e40ae0ef326c2803c8
- SSDEEP 98304:1bD0+Cga+JdXN0B7+siUbYZfgs0QlxejoYevoirV0t/iLwHft8vAzjok:1bDsj0U64sIo/jrOOwH+vAok
- TLSH T102E6171166D48FE9C06FD070C95266B6D633BC868E319FCB1580BE2D3E766A05E3522F
- MD5 SHA1 SHA512 SSDEEP TLSH