Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 04:31
Behavioral task
behavioral1
Sample
2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 16.2MB
- Sample260701-e5dy6set3q
- SHA256 a4b223f5c74e57daf75b770c2c5fefea3440ae474715cbced6e702e7c6ea5832
- MD5 6b57a03569a4a8ddacc7bb25ac5d95fb
- SHA1 42cd7203a20b8474b29cb9548d77ac5e34b9037a
- SHA512 9302c35351fa5eaf2efc9f5ccf25c665b9aa9d6c4b2b50dcaa3071266d6bcdbc5ee996cf56468702f3743245e623f6b70f4146cf3fc322ea97700afc7f2618bf
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YoGIbUwF1VERmj2bk:ERXMzdlT/d6YVIY092bk
- TLSH T10C07AE55F273317CC227957481699E33B9303C551B208DBB9588F6742E37AB8A93EB32
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dxdiag.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netsh.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\format.com 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\certreq.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\help.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\where.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\user.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrs.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttune.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/4488-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c51b-5.dat upx behavioral2/memory/4488-316-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4488-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_f4339379cb9217a5\pwlauncher.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\r\charmap.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.26100.1_none_ac6c889a5b4138e1\aspnet_regsql.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\r\CompMgmtLauncher.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1150_none_0ba6100513fbb80d\RMActivate_ssp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.26100.1591_none_73076b811b15bddd\r\VMCreate.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\IMTCLNWZ.EXE- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\r\extrac32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1_none_0f32fd2fa8c53bd5\rekeywiz.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2cc651b7f8fde87f\taskkill.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_3b8c278ba0146cc8\tzutil.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_255c949d766547ab\aspnet_state.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_14d2f3235b5beec5\msdtcvtr.bat- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\SpeechModelDownload.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\r\regedit.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\r\OOBENetworkConnectionFlow.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\iexpress.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\convert.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\r\ntkrla57.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\r\UsoClient.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1150_none_e8e8f4e033ce6e38\at.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_73fd08cefdd719a5\RegAsm.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmmon32.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\mcbuilder.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WMIADAP.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..bootencodeuefi-task_31bf3856ad364e35_10.0.26100.1591_none_8f5a876d69245542\SecureBootEncodeUEFI.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_e6fd26a1f7fbb233\comrepl.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingShell.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WebExperienceHostApp.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\vmcompute.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\r\mmc.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\msconfig.exe- 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_6b57a03569a4a8ddacc7bb25ac5d95fb_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4488
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.1MB
- SHA256 4a74199cb02848c73c2e803a57cdc6bdee5872dec5e0aedddf1a9bde026a9e03
- MD5 222cebda236f752d16dc4821065e14c5
- SHA1 3ce0195fc273fac7831568ac20636e276e73e4f7
- SHA512 8aaf8029574c174d4e1253f020ddf2cb53fce23e7916e69ba5e97d14bed82d98f662e98b3da4a86d24c5bf9f456c0ebf1b5a9bddc2e3cf447db0f7fd60e2d441
- SSDEEP 393216:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2Ig8/d6YoGIbUwF1VERmj2b/:ERXMzdlT/d6YVIY092b/
- TLSH T1EA079E55F272217CC227957481A99E73F9313C511B308DFB8189F6742E37AA8993EB32
- MD5 SHA1 SHA512 SSDEEP TLSH