Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 12:45
Behavioral task
behavioral1
Sample
2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe
- Size 15.0MB
- Sample260506-py2f1abs4s
- SHA256 c32bbed9917eca49ebf42d80c68d49605772dfe86428d9abee5784e80fba01ad
- MD5 1d14925174c298da0f78f4d56d84f68c
- SHA1 66f73d8c05b042ca1b7b6972396b6c47262104a9
- SHA512 75305ff542190ca05e8bf120e5ede81eccf53843805ea54c1329dc50bf2a7c1b0a25bcf3d7cd19ecb0f0dde04a75bb80f8080cfb1bd7af06560172d18caa7344
- SSDEEP 98304:esQ/pr211K8UbYUOgSjoS/PvOAjcXvvOOc59dY:CM1M8UPEoMHOAoXvvOldY
- TLSH T134F69E2E77A841F9D17BD1B88A56D516E371B8008731968F13A4876E2FB77E24E3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\where.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\sort.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\findstr.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\user.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\logman.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\print.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\find.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\finger.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\subst.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\user.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\expand.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe -
resource yara_rule behavioral2/memory/3876-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002200000002b133-5.dat upx behavioral2/memory/3876-362-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3876-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817\f\ssText3d.scr- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.22000.1_none_decd95c405f1ebe0\ktmutil.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.22000.1_none_9929679adadef360\powershell_ise.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_c21dddd4c8838023\netiougc.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_0f681b8c9b834caa\f\PinningConfirmationDialog.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.22000.318_none_2a48e0773b83147e\f\appidtel.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.22000.1_none_6f96a08b64cc0ef2\msdtc.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.22000.1_none_3277593d92fa7a4c\imecfmui.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\f\refsutil.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevTemplateConfigItemGenerator.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_4cf7a08cff0239cf\r\explorer.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.22000.282_none_305eac6918e57702\r\rdpsign.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_58ed4d9536066242\Utilman.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.22000.1_none_a03bdcb625ffa5d4\WsatConfig.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpksetup.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowsdeviceportal-core-server_31bf3856ad364e35_10.0.22000.282_none_0536e7ab81ae6453\f\WebManagement.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15806.0_none_aae08517a75cb984\aspnet_regsql.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpupdate.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\f\msinfo32.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_c3e1e602251fe636\Register-CimProvider.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.469_none_59f2db2aeb94e019\r\WpcTok.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_a6b2722d9eed2eed\f\fixmapi.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.22000.1_none_4d8388bf67ce9090\pwlauncher.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.22000.1_none_6cbbdad227c57e28\sihost.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_de6b1af4069aa942\dpapimig.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.22000.1_none_f6bb136dce337547\driverquery.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.22000.1_none_4fe921868d7ef368\mobsync.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15806.0_none_f04d7e19d4274c7b\AppLaunch.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\AppVStreamingUX.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.469_none_4ee2cfd406c59bc7\f\omadmclient.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\diskperf.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.282_none_d171f6f246e51c59\f\spoolsv.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.22000.1_none_72526c5b8ceef21d\WmsManager.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\curl.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_636efb509c9a3cee\certreq.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\RecoveryDrive.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\r\GenValObj.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\r\TrustedInstaller.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\r\MoNotificationUx.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.22000.1_none_e057a941e5a6e3d6\isoburn.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_a8719e3ea40f5d74\sxstrace.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.22000.318_none_7f5bff6941991869\vmsp.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.22000.1_none_f318e861ad1b476f\convert.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.22000.1_none_fddec9b335fe82b5\dxgiadaptercache.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.22000.1_none_38261a83872276db\dnscacheugc.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.22000.1_none_465538b86426586d\Mystify.scr- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.22000.282_none_8c338754d2830d3e\f\TrustedInstaller.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.318_none_6f1f7e973e7f527f\LaunchWinApp.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\f\VSSVC.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.22000.120_none_a5bf55f88f23c8b5\FaceFodUninstaller.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\r\printui.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.22000.1_none_13d214402b909a8e\mavinject.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_9f38aa7663fcbf45\r\control.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\SearchProtocolHost.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\ScriptRunner.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\r\LaunchTM.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe- 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\write.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_1d14925174c298da0f78f4d56d84f68c_agent-tesla_akira_amadey_cobalt-strike_darkgate_elex_gla.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.6MB
- SHA256 a95032b870c4c7f0936d85bc530e8fd738b8ea26e0624772f27962cb9892e65b
- MD5 ee2ea1016137079c01c6a8eef608ce44
- SHA1 3b7d72775818320080ecb0795b3896397c7bf42a
- SHA512 391c22e93c94e30b5581dedd05fc1e332cc59c6eae1cef79db4f3276bb86ac8e671f2accfe4ee4a52ac8c6995a98cf438fe7015c3493ecee9da932b9324194b6
- SSDEEP 98304:esQ/pr211K8UbYUOgSjoS/PvOAjcXvvOOc59dQjov:CM1M8UPEoMHOAoXvvOldiov
- TLSH T18BF69E2EB7A841F5D177D1B8CA96D516E671B8008731968F13A4876E2F737E24E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH