Analysis
- max time kernel
150s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
- Size 14.9MB
- Sample260701-gdt77ag13x
- SHA256 e50e872a91f9bf6bfd11e25ae4a017dc437fee1ff9111c1bf7aee891ee49bf3b
- MD5 355a5011a8b89f452c200cb7a2ce736f
- SHA1 fae81ea3e3f3a024bb89ad28c613309c8ffa9565
- SHA512 7a847130acd73584cd4c4ecae06547fb750cdae554c88d7b1b32a72472335b0193fbaf8f54dc3f2379635ca6cd3dddc35e38c2c9ff7a621159ee67e9f3d4f67a
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIYeGZF6bUpMBF1p/kjRm4OWi2bS:6wOTKqzBQZIbUwF1VERmj2bS
- TLSH T16FF6BF1E729504ACC55BD078CF868526D7707C8A4BB1A5EF2284A3A92FB76F13F39314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\svchost.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\at.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\control.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\certreq.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\comp.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\fc.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\runonce.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\userinit.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\calc.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\choice.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\net1.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\logman.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sc.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\help.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\curl.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dccw.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_bbcf7a15a36f8b3f\runonce.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\msil_datasvcutil_b77a5c561934e089_10.0.26100.1_none_6ea9e81d0ca2fc8b\DataSvcUtil.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\r\msconfig.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\r\Setup.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\rdpinput.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\runexehelper.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_5ac6e18046b72d8c\where.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_10.0.26100.1_none_a454f54474148daf\dpnsvr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\r\proquota.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\msdtc.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\GenValObj.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\gpscript.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_60a5ff2e85104e26\SystemPropertiesProtection.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\r\stordiag.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_c8691d618eec1ae9\CasPol.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\phoneactivate.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\r\TabTip.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.26100.1591_none_381f2a62bcc881c7\mfpmp.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.26100.1150_none_db82af066c7c007e\r\bash.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\TCPSVCS.EXE- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\SIHClient.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidpolicyconverter.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\wermgr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_18d76879146fa99e\TabTip32.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bcdboot-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_fd3d350bee0e4f11\bcdboot.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiWorker.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\LaunchWinApp.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\HelpPane.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\explorer.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_af2434cfb8eecc10\clip.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_355a5011a8b89f452c200cb7a2ce736f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.8MB
- SHA256 0f42548d5866e20074b49b80a2a22298226c66a0cfe140423f87ecc3d3cf6c02
- MD5 aeda8287a91954e0d8408ce8dc4b958a
- SHA1 d4924104c23c4f3eaf789321b42a6cc4bdcab9f9
- SHA512 52c57b9d519f42feb2d7146cee5eb32cf3ac0475c1ce07c3a64103a9fc6ab233b7f9df3d137985cbc9f63e2f81e55c5eb826d10e460e6dc1a65d79e4b8c38154
- SSDEEP 196608:Su5oaHOAoXvvO/qzBUdEcIYeGZF6bUpMBF1p/kjRm4OWi2bQP:6wOTKqzBQZIbUwF1VERmj2bm
- TLSH T156F6BF1E72A541A9C16BD078CF878526EB707C8A4BB095DF1284A3A92F776F13F39314
- MD5 SHA1 SHA512 SSDEEP TLSH