Analysis
- max time kernel
149s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 10:20
Behavioral task
behavioral1
Sample
2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 11.0MB
- Sample260506-mdd4vsft3v
- SHA256 cbc8d9cd64d4551bf49bd5a8d1ef18e89a73e8717f7bb2e996603a3bb913988c
- MD5 1b7a2e77a92f652bb698d7e18c61857b
- SHA1 89a5b6a59dcbf4aed1e405926f470dfef9060531
- SHA512 e322e01ba58d905bc3d8408193ea18b2465e30730528e6302c0710b8ae208d0f07c84f895800d570fc413320a02675d97a5a2c91d03b08c4e14ea0f9171f11bd
- SSDEEP 98304:f2g1PTJxjRXzBTIOSAKevoirV0t/iLwHft8vA6fkZcC:eg1LdzBTf1jrOOwH+vRPC
- TLSH T197C63819BAD48FA9C05F9034C96266B956237C568F319BCF2940BE29BD71FE04E3121F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1f7-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001d00000002b1f7-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dism.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmd.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\convert.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\reg.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\user.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\clip.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systray.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\proquota.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001d00000002b1f7-5.dat upx behavioral2/memory/4568-598-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4568-3182-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.22000.65_none_ac11e3d68c043701\f\BootRec.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_38378aefc68a365f\autochk.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.22000.1_none_9ecf8c975ae30adc\replace.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\TSMKUFIL.CMD- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\r\SpeechRuntime.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.22000.1_none_0812eff10a63b4d2\diskusage.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_eb29ce0d02c88de7\r\ntprint.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\AuditShD.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.22000.1_none_23bf602c090692bb\NetHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.22000.1_none_5a8d82c2eebc5ec0\compact.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\WerFaultSecure.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\f\WerFaultSecure.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\vds.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\r\SearchIndexer.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_987098e149e09f68\r\msinfo32.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\user.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_de9c072f19e4a666\vbc.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.22000.1_none_9aa7aae5bb401974\fontview.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.22000.1_none_010c2089229afa0b\fsavailux.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_b7c933829422be28\netiougc.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevTemplateConfigItemGenerator.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.22000.348_none_a52aaf9adfbcd9fc\fontdrvhost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.22000.1_none_63c1e7db07fabcb1\msoobe.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\tpmvscmgr.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.22000.434_none_17cb2e5ad35a58c9\ksetup.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.22000.1_none_b60008c7dd9ead92\CompPkgSrv.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_c4e0220059a427b2\CredentialUIBroker.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.22000.120_none_fbcb84a27b36694e\f\BioEnrollmentHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.22000.1_none_8a2a9fc5ca3ef1e1\dwm.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.22000.1_none_ce9abaf7344caba2\regsvr32.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\TiWorker.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.22000.1_none_35b70fce5fba56f3\tabcal.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\f\LaunchWinApp.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.22000.434_none_8c8f05900e25e4d3\f\net1.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_4d19d7f0fee9ee87\f\explorer.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.22000.120_none_6b23f06ce93f4f52\f\RMActivate_ssp.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.120_none_68fb744ea962915c\f\conhost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.22000.282_none_04af1ce80d4a389a\r\ie4uinit.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.282_none_e2966659594e32a5\r\LockApp.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_98ecfb26dc5bb1d2\wab.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\SecurityHealthService.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.22000.1_none_57e0cfd01d70414f\SystemPropertiesAdvanced.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_41d7e8fc138ead52\scrnsave.scr- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.22000.1_none_9033bf3e0d1a2461\SMSvcHost.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_902756b93bcc4aa2\vbc.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.22000.51_none_2158495b1874d95c\f\services.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_3353a48da9fe01a4\f\AssignedAccessLockApp.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\f\CapturePicker.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_eeb0f55fae54e327\wextract.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\BioIso.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.22000.1_none_7f6d0f07b0ce31f2\qwinsta.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVDllSurrogate.exe- 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_1b7a2e77a92f652bb698d7e18c61857b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.5MB
- SHA256 2fb399c70629b63e9c5ff71a2b21f601ae12a78d12d44087e83ec71de30675f3
- MD5 ad5925b2a36111a79e641d6ffa96038d
- SHA1 5da5d9a112c2f31b774f181caceb7993d5abba45
- SHA512 923e58cd9a025e8c48b66d50976682c73b628e1e3d608f6298b72b06ef0472de622deb506fed365728974c873fc1288092c6faaf2400f022645fa896e0594c4a
- SSDEEP 98304:f2g1PTJxjRXzBTIOSAKevoirV0t/iLwHft8vA6fkZcujol:eg1LdzBTf1jrOOwH+vRPool
- TLSH T10BC64919BAD48FA9C05F9034C96266B956237C568F319BCF1940BE28BD72FE04E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH