Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 00:34
Behavioral task
behavioral1
Sample
2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
- Size 21.0MB
- Sample260425-awsnraf17j
- SHA256 f0081876c5199058e8464c989087dcb3d11f17e4f5301f42e6b5fc3a8f529af8
- MD5 4ec22ca9c408f1b7b97c89a49e90b460
- SHA1 d1c3e67834ac45bece5f2feed8b315ae61716571
- SHA512 48c98ecf205ebfd2ec9566636d48edfec1e527af32674dcd23093962fa4a5e66b5f92b9905f15792cf1efcf04d504ecc184d200e9a01607caca089e8e20556cd
- SSDEEP 196608:3ipKD0OdjBnvjeApaAvkt1vUpTfejrOOwH+vDdU:SpyjNvjtIAvkuGjrOB+G
- TLSH T1B6277D036ADC8BA5E06FAD30CD2596B546237C458E309BDB2DC07E197A712D16E3D32B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001000000001f15c-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001000000001f15c-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\auditpol.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\newdev.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\wscript.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\choice.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\certreq.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\format.com 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe -
resource yara_rule behavioral1/memory/4196-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x001000000001f15c-5.dat upx behavioral1/memory/4196-257-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4196-3215-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{C15F3967-CA06-41DC-B7DE-6639B0FBB3CE}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpq.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.19041.1_none_3e243d8308cd1079\aspnet_wp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\ApplyTrustOffline.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\r\IESettingSync.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_3e722592e777a760\AppLaunch.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_0e40322ba49953c6\cacls.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\r\CIDiag.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\CallingShellApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_dc7caa836f08ad57\f\regedit.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\f\ResetEngine.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashPlayerApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.19041.1_none_72d3d2875ff2c886\attrib.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\f\CloudNotifications.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\iexplore.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\PickerHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_9d61200c734f61dd\LockApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_60c397ff12ee4db1\w3wp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\f\sdclt.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\DWWIN.EXE- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\r\PickerHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\quickassist.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a7a9eea53631000d\aspnet_state.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_27f9f931a79d1cbe\mavinject.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\f\ChtIME.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\r\msinfo32.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_98f5b8d3db68981e\dcomcnfg.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\cscript.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-add.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\r\diskpart.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\AccountsControlHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\wslhost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.746_none_88402ba139c8967e\dasHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpshell.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\r\TSWbPrxy.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.19041.1_none_70349c6644208282\tsprof.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\runexehelper.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\appidtel.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_aa284d65c7bee591\f\upnpcont.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\drvinst.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.19041.1_none_075470a68fcfb411\mount.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.264_none_a71c9f7fdcd899c5\SearchApp.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\sppsvc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\r\cttunesvr.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_260e545bf60f6b0f\cliconfg.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\msra.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\Setup.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmmon32.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\WindowsSandbox.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\f\wevtutil.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\rstrui.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.19041.906_none_388c7870566ba06d\WMSvc.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.1_none_de2fb5dcf9b35f74\taskhostw.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\r\CredentialUIBroker.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.19041.1266_none_1f1ff89fbf279f16\f\FaceFodUninstaller.exe- 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_4ec22ca9c408f1b7b97c89a49e90b460_akira_amadey_cloudeye_cobalt-strike_darkgate_elex_glassw.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 21.6MB
- SHA256 b601fff2c208dd8c6e10b13430536c6db91212af4ea5d767e4e3232749a20785
- MD5 0b67ccbdfbe2e8fca605a8a5d56467ac
- SHA1 e40992a85a01c7360d56aa321f38545d824efef1
- SHA512 e3c92c850e2de645616370e45baa9ba2124e66630727ddef1e347bbfe00e61ee46a317cb369e355a8f9120a2b622a1e0d83eba2945ac3d8f6f9b3be4c8231542
- SSDEEP 196608:3ipKD0OdjBnvjeApaAvkt1vUpTfejrOOwH+vDd+oM:SpyjNvjtIAvkuGjrOB+zM
- TLSH T1DE376D026ADC8BA5D06FAD30CD2596B546337C454E309BDB2DC07E197A722E16E3D32B
- MD5 SHA1 SHA512 SSDEEP TLSH