Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 00:24
Behavioral task
behavioral1
Sample
2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
- Size 10.6MB
- Sample260506-ap3kdagx21
- SHA256 cd5a4b22421af928d640fe2160f5592b243bf9f76362668264442dad18efd86b
- MD5 03dd8126b24f8b58e3006fd9a78125d5
- SHA1 22c20266ce5336e6b31311b66a35275087002c9c
- SHA512 86fb49bac6aa028a9b7d81bab6064db60ece65fe4c9e25b5a2e01ce97a00b47f6f64c2f8f6428eec33028de3b02ea10096225d7f08f5613cc6945a9cf4a331f6
- SSDEEP 98304:f2g1PTJxjRXzBTIOSAKevoirV0t/iLwHft8vAJde:eg1LdzBTf1jrOOwH+vede
- TLSH T18CB63819AAD48FE9C05F9034C96226B946237C568F319BCF29407E29BE71FE05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000300000002a1be-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000300000002a1be-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ieUnatt.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\instnm.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\setx.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\resmon.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\autochk.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\cttune.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\SysWOW64\print.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe -
resource yara_rule behavioral2/memory/4728-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000300000002a1be-4.dat upx behavioral2/memory/4728-716-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4728-3178-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\f\slui.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\r\AgentService.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.22000.120_none_842c9d9e843cf6c7\r\ISM.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.22000.1_none_6299da14be99f6ee\regini.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15806.0_none_ae81a34e9485c0b6\EdmGen.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.1_none_f3552e31fa0ca962\WUDFCompanionHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\r\dtdump.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.22000.1_none_e0cdafc35d48718b\RmClient.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_c4fc5204471c8488\ttdinject.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\f\FileExplorer.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.22000.65_none_cc4646d618bda56e\r\SystemSettingsBroker.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\USRLOGON.CMD- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.282_none_81f8a77609cf735a\f\MoUsoCoreWorker.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpconfig.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.22000.1_none_9aa7aae5bb401974\fontview.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\printui.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.22000.1_none_2c29ad827f986a34\TSTheme.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.22000.1_none_b4479544aa259d14\WallpaperHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\winhlp32.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\Microsoft.Uev.CscUnpinTool.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.22000.1_none_8ad2d5434aef8a0e\SrTasks.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.22000.1_none_5ba5eadfaddccaf4\wecutil.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.22000.37_none_46638c67a45b1942\f\MusNotification.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\f\explorer.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.469_none_160103e31c4d8d88\f\SystemSettings.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.22000.1_none_7e86cfd75f1ab7ff\tasklist.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_aa689c124bcde8ee\r\CheckNetIsolation.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\f\SIHClient.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6744583bcc1cfbb4\aspnet_regiis.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\MsSense.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseSampleUploader.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.22000.1_none_c5b187e40e57e8e5\fsquirt.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\wscript.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.22000.1_none_503e35b8511f6ade\MSBuild.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.22000.1_none_50334ea3c95884c9\XamlViewer_v0300.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchFilterHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\r\WUDFHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.22000.120_none_aad7a0687fb44b43\DeviceCensus.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\ie4ushowIE.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.22000.1_none_3c7644c59e04550c\isoburn.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\PrintDialog\PrintDialog.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\f\NcsiUwpApp.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_7a0735d8628d0c40\dxdiag.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.22000.1_none_76ba4fbc0aad4f59\wermgr.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.22000.1_none_008a7e7adfc26529\dasHost.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\r\MoNotificationUx.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.22000.1_none_3d7fbabd1601d8b8\cmdkey.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.282_none_78d41497d781352f\r\SpeechModelDownload.exe- 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe File created C:\Windows\hh.exe 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_03dd8126b24f8b58e3006fd9a78125d5_akira_cobalt-strike_darkgate_elex_glassworm_hijackloader.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 11.1MB
- SHA256 f5f70bfdf0a18c00492e1ffbd7169446e4e7381e28bb83534d2fd781e6b498e4
- MD5 8d944f45908c8ee52fc5310035f34f72
- SHA1 f3faa265ab528618a92157e92867430c968cc997
- SHA512 a74323feee9477e135c2c52b4f4e0393068c87bf9aed3812820f6dff185936d1c36b3e6aac0ec3a1126a468a965c08bee019b461a48bfd0353155132a36a99be
- SSDEEP 98304:f2g1PTJxjRXzBTIOSAKevoirV0t/iLwHft8vAJdyjo0:eg1LdzBTf1jrOOwH+vedko0
- TLSH T1D3C64919BAD48FA9C05F9034C96226B946237C568F319BCF29407E29BE71FE05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH