Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:44
Behavioral task
behavioral1
Sample
2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 12.7MB
- Sample260705-eanj5ahs61
- SHA256 3fc377a7cd429414ee876ec4b4706a89ac15599597ef27164a61e15c76751419
- MD5 71168701764a2586590a0133d915a0dd
- SHA1 bca65812ffada71972e85ee7d6fb5935d2a13dc3
- SHA512 d675d2513aba2091dfafc16fd0352cdfa8db5f39c7403c5f63d0ac8a15744324f1e476fb8665f36f68b121c3d91b82ec9b459410b23072d8ffabaaff1c088cab
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJedf:ERXMzXdyZ/K0trFC4QQ
- TLSH T11ED69E13F2F40166D076D13DCB925625EB713C5A4BB0C6CFA158B3991E377E1AA3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001100000001b9e3-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001100000001b9e3-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1972-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001100000001b9e3-5.dat upx behavioral2/memory/1972-377-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1972-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\r\certutil.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\FileExplorer.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\r\msoobe.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\chcp.com- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.712_none_1b914f4a8d4789f2\r\notepad.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\r\vmwp.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MsMpEng.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\r\imecfmui.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\SysResetErr.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\r\TabTip.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\ftp.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpService.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_af2434cfb8eecc10\clip.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_4fd441a3f30753ec\replace.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\mstsc.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\r\IMCCPHR.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_cb7026b6ea62c346\whoami.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_6afaa980b9711021\SystemPropertiesProtection.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\AppInstallerBackgroundUpdate.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\CameraBarcodeScannerPreview.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\r\psr.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\IEChooser.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_71168701764a2586590a0133d915a0dd_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.6MB
- SHA256 79919d2be9c48a297554f86c53fc815819e053a01dbf5fc0e1f7ac5197eb270a
- MD5 c3654fcd5d1ff7634ac47676e0a9c250
- SHA1 7641e5db2fef0a05a4ba4cea3aeab8e4aaf0e190
- SHA512 3794e124a576bfc924b4fe9bfe4a1c07ca8140c61d8ab1ffb7be1b15856e3d0a4f7a67a27634ec92a70a36bd902342ea4befa497e572ba6b43b5555936bdba36
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJed71:ERXMzXdyZ/K0trFC4Q2
- TLSH T1F6E69E13F2F44266D076C179CB925629EB713C564BB0C6CF6258B39C2E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH