Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/05/2026, 12:19
Behavioral task
behavioral1
Sample
2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 7.1MB
- Sample260502-phkhjsax2l
- SHA256 84ad63df325cae3904bac0e16961a9caed0ef329941309c4bda0d7c659675ee6
- MD5 fbc62b9fc3c79ef68b0fd006c4bcb15c
- SHA1 45456e165e052abee3cd77562d238fbacc8aee23
- SHA512 2024fe61d31c98c6908f2d4d87353b714f03f1f2bc73388cda345c2b9319ea88394937c759a4cef052fa5a37a1e8fea618fd6c2b9fd9aa25488ffde0ee241876
- SSDEEP 49152:fkYwCOAIR8Z+qJtb2Ir+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2As:fFIiZ+P/PvOAjcXvvOOc5AC
- TLSH T16676171B6E9D8760C83FBD748E55C684D130BC008762A59B2DD07F5DEAB36D9393E222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\eudcedit.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tar.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\at.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\charmap.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontview.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/1112-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0009000000021698-5.dat upx behavioral1/memory/1112-760-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1112-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\r\audiodg.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\r\mighost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\refsutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisreset.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\sethc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\r\MicrosoftEdge.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_228521f0037fd996\PickerHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\agentactivationruntimestarter.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\f\Taskmgr.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\r\msconfig.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\ssh.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\r\wbengine.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.19041.1_none_a2c8d19f92a1cc22\PkgMgr.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ls-adschemaanalyzer_31bf3856ad364e35_10.0.19041.1_none_89e9f21ed63037f6\ADSchemaAnalyzer.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\r\BitLockerDeviceEncryption.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\sdchange.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\r\mofcomp.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.1288_none_f92f7256107c0e35\r\nvspinfo.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.19041.1_none_76edadec5ba257b3\verifier.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\logagent.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\msconfig.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.84_none_027c502c6e331223\SppExtComObj.Exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\r\wordpad.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_a3224c6911783037\IMJPUEX.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\f\dxgiadaptercache.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8298e4b5b7fd2c26\iexplore.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_cd1cbc8db3875f47\csc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\CameraBarcodeScannerPreview.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.19041.1_none_fad576d8cf74b38a\dispdiag.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\ClipUp.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\dfrgui.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\eshell.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\rasautou.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\TrustedInstaller.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\f\winresume.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WMIADAP.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\f\iissetup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathinputpanel_31bf3856ad364e35_10.0.19041.746_none_a89acde4afbab635\mip.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\f\DWWIN.EXE- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\r\LockAppHost.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.844_none_95c651508e565d13\r\provtool.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\f\WSCollect.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\MoUsoCoreWorker.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.19041.1_none_904f8b459208b3ae\RegAsm.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_513ab7577ca57427\SpeechModelDownload.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.1_none_623e57cb80e184b5\PasswordOnWakeSettingFlyout.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\r\wifitask.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\RdpSaUacHelper.exe- 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_fbc62b9fc3c79ef68b0fd006c4bcb15c_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.6MB
- SHA256 eb5e8dbf5a858d0431d7da1c3826c818b37098be00c1157bf053a48ff54f4c48
- MD5 10271be7b3f1782c2bd6059eb544d42a
- SHA1 ddbfca18b58a7fe3c63261b09a4b182fa799daed
- SHA512 151637b9595ab94c05dd69cd7510a12c7cddcf0ec7849da3e3419a377f430314e9e870f4ad912bcb848f3e2d1b9e7fe2863f6e6f9678364aa457ac50c6a533d7
- SSDEEP 49152:fkYwCOAIR8Z+qJtb2Ir+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AE:fFIiZ+P/PvOAjcXvvOOc5Aujo+
- TLSH T14986171B6E9C8761C43FBD748E55C685E1307C008761A98B2DC0BF5DEA736DA793E222
- MD5 SHA1 SHA512 SSDEEP TLSH