Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
11/05/2026, 17:34
Behavioral task
behavioral1
Sample
2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 14.8MB
- Sample260511-v5j37abs2k
- SHA256 17aaa304380e0f83d9e52204f73e938959e3908bc28dabe89eb32b4076b611ca
- MD5 da891b67bfeec8ae31124a8444ab7ed0
- SHA1 21afacfb72e23714ba63be140f0279b5b1ebd698
- SHA512 0312e19f38fb6cf99750add759867bfb04c1ca1eea049ffe242624ec0ae189e3f2d2499e1e17170bd1028e00b906bccfaa8749db304bde2d4282524d3401ca11
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrd4onF+CiF:ERXMzn6YoIgBndQ
- TLSH T154F66C59F27662BDC227C078819ADA37F93038415B204DFB9188F7782E37AA5593E731
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\secinit.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrs.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\curl.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\compact.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/3352-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001f00000002b172-5.dat upx behavioral2/memory/3352-541-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3352-3187-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.22000.1_none_5a68555768bbe5b5\rdpinput.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\f\SystemSettingsAdminFlows.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.22000.1_none_d094352fcb43807d\InstallUtil.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.22000.1_none_f8cbc2844276ec6f\grpconv.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.22000.1_none_0af1ba5c97d13826\rpcinfo.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.22000.1_none_f75fca0a76179c59\WmsSessionAgent.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15806.0_none_0607cd955dab15ad\MSBuild.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.22000.434_none_14b16ab1e534f40c\msdtc.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.22000.1_none_4dc986ddab447f27\IMJPUEX.EXE- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.22000.1_none_2a7bb19b5dc345cd\SystemPropertiesDataExecutionPrevention.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.22000.318_none_94e400242f9bfd4a\r\control.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.22000.282_none_8a68951ea6251dba\r\wkspbroker.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.22000.1_none_b4479544aa259d14\WallpaperHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_0a23d387a9386cf0\appcmd.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\conhost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.22000.1_none_e267df21b2c3a4b4\easinvoker.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_9ed8cb052ff869e6\f\TokenBrokerCookies.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseCncProxy.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\Taskmgr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\SpatialAudioLicenseSrv.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.469_none_83da02152447c976\r\CustomShellHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.0_none_7d39f9a025126e55\mscorsvw.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.132_none_7958838972f5ba04\LaunchWinApp.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.22000.1_none_4c569ced0ca81910\setup16.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_a003f3391feff8a5\r\repadmin.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\ResetEngine.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.434_none_b4a3a74a80427a96\CheckNetIsolation.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.22000.1_none_2a646c04920783d6\msfeedssync.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\AuditShD.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpconfig.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_c1a3421d8c97478a\f\SndVol.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_4a72530ae0a1ba07\regedt32.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.22000.132_none_2eb02d05c34e2eef\r\WaaSMedicAgent.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.22000.1_none_13d214402b909a8e\mavinject.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.22000.1_none_7b86f3d8c7ad2322\dccw.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_ef0bb92fa937f7ee\f\RMActivate_isv.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\sdchange.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vercommandlinetools_31bf3856ad364e35_10.0.22000.1_none_10872c88a98c0f77\tsprof.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\r\TabTip.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.22000.1_none_c5fd122e0036c04c\EdmGen.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.22000.1_none_c5af807aa8d61858\gpscript.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tscon.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_c87c050022130145\f\userinit.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.22000.1_none_fda4ea8a1051069a\dpnsvr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\SpeechRuntime.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.22000.41_none_6fef9dc502cda133\f\IcsEntitlementHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.22000.1_none_a345420f88ad9925\at.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.22000.1_none_d18b284aa244a1ec\backgroundTaskHost.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.22000.1_none_6e22e868f79867b0\msdtcvtr.bat- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.22000.493_none_47936afef938817b\f\ntkrla57.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\r\ResetEngine.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.256_none_ab582698a8953fd2\ngen.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.22000.1_none_07efd2effca007c3\PresentationFontCache.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.22000.1_none_76531c94f831c76b\runonce.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.22000.120_none_8c1e5976c0145439\PkgMgr.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\r\vmcompute.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\aspnetca.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.22000.1_none_94f967582c19a4b8\GamePanel.exe- 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_da891b67bfeec8ae31124a8444ab7ed0_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.3MB
- SHA256 d62f0ae0579058ea4870195afed404f48da7f3b38626911712636e1abc30ebfa
- MD5 8ac2e1c529d9ad4c5bc9439f422b2651
- SHA1 dd9ea011776bd98bc63d10137f786c2d603b0130
- SHA512 1a95b7cf9e898c1b17195ba2f8150887ab793f3a36a6da3932609e10bc213ba0cdad72c64bcfd1a5f611093fd6071125514534b6ba618151797ba13be1adbf6e
- SSDEEP 196608:ZaHxXME6o966HtIto0Ap6g5qPKrd4onF+CiFo7:ERXMzn6YoIgBnd97
- TLSH T170F65B19F27652BDC127C078819A9A37F93038415B208DFB9189F7782E37AE5993E731
- MD5 SHA1 SHA512 SSDEEP TLSH