Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 03:45
Behavioral task
behavioral1
Sample
2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 12.8MB
- Sample260705-ebk6dscy5n
- SHA256 d7859cbc986df74eb0807edc0ed95efb2f62de09118fee550f422ec385a66570
- MD5 64a767ef52d67bccea1ba64a3e939a1e
- SHA1 840d2484ad7adff53e3413d4eed6683770dd8137
- SHA512 5a9adef5de8d2f79b1d0d2e8d22de6d5d6db2b57440c1f0f57252233d4477048d29242844c22be4c79846b80dbca033a48888b7b462a4d61a314e4e665f7b91b
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJbos:ERXMzXdyZ/K0trFC4QKs
- TLSH T140D69E13F2F44266D076C179CB929629EB713C564BB0C6CFA158B39C1E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b2c9-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b2c9-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskperf.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runas.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/3468-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000300000001b2c9-5.dat upx behavioral2/memory/3468-335-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3468-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.26100.1742_none_b6069a8cd10e9cfa\sppsvc.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\CertEnrollCtrl.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasdial.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_08f23f1b0a87acee\getmac.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\TCPSVCS.EXE- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.26100.1150_none_cccbe77f5e2ee6e2\r\aitstatic.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5542cd086dc867d0\cacls.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\chcp.com- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_c99b7f92812c4030\iexplore.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\r\osk.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\fc.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\r\certreq.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\ApplyTrustOffline.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WmiApSrv.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1150_none_ad5d9bcb00930036\ndadmin.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\r\mount.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1_none_d63cd2082238f294\wiaacmgr.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_49f1b033747ffae2\wab.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_697667281e7cce2c\AppLaunch.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\InetMgr.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1_none_6a9bcd9421c5bb20\ieUnatt.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_64a767ef52d67bccea1ba64a3e939a1e_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.7MB
- SHA256 ff9cc4d8df05a7d3d0aaa62180873f5be36b5dd63d4d284d212ebf1c56fb6ad2
- MD5 24cbbe259d438b7552d3fc54b0da8035
- SHA1 9ff7b3ee1f221c71e5bdd83cdbacae9109ce5eb9
- SHA512 0e4809675fc5a5e0265a5a2284ed6df7dae0d8ca9191db12fd1b8c18467b4834ab9f7bc151aa816172cdb128d355a917e7307a27f6d3f88b033588970afa931c
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJboCY:ERXMzXdyZ/K0trFC4QKb
- TLSH T1D3E69E13F2F44266D076C179C6925629EB713C564BB0C6CF6149F3AC2E377E1A63A322
- MD5 SHA1 SHA512 SSDEEP TLSH