Analysis
- max time kernel
150s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 20:05
Behavioral task
behavioral1
Sample
2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.4MB
- Sample260707-yvb7dadv2t
- SHA256 b89f203f18a17a6723633474baaffc889ec2294229f5c161d69c75694fc23320
- MD5 a1d3ca4a3ecbd4c56af86143991b512b
- SHA1 e0e27627a21d49f8c416526e0055a523d5b8e4b1
- SHA512 92c0b57a3515e5395283270f2a9f280c2c35737d98cadce10557e9dc6b7aaddeafc0c026c0d30ce80f688db578a3031c1884fb851cd0b2ac654cc898ebcd625f
- SSDEEP 196608:WYGt0La39CZhMTfhcIQeGZF6bUpMBF1p/kjRm4OWi2bT:w7oZSKpIbUwF1VERmj2bT
- TLSH T109F6CF1272E404A6D16A913ACB22863597B17C2A8FF2C7DF315076CE1E736C17A3A717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000400000001b6f4-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000400000001b6f4-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpresult.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msdt.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regini.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1556-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000400000001b6f4-5.dat upx behavioral2/memory/1556-326-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1556-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_b9d66d642921dc90\attrib.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..bootencodeuefi-task_31bf3856ad364e35_10.0.26100.1591_none_8f5a876d69245542\SecureBootEncodeUEFI.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15912.0_none_c2b647ba71508734\dfsvc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\DiskSnapshot.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_47a47970066d8602\r\msdt.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\wpr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\r\UserAccountControlSettings.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\r\wininit.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1150_none_f9eb481555467227\r\WallpaperHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_42528c82d31b82f1\cvtres.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_a44e7056d0e44981\TpmTool.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\r\sfc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\finger.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\dsmgmt.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\splwow64.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\sethc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\eshell.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\r\ShellHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_6694132cb1b96a0b\dfsvc.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WindowsBackupClient.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\r\LockScreenContentServer.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\TextInputHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\Robocopy.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\r\CCG.exe- 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_a1d3ca4a3ecbd4c56af86143991b512b_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1556
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.3MB
- SHA256 bfc419b0a5314000027413bf1e73d8bf0a42a39a9e7d78147ad7e9ed32b06675
- MD5 936d72221560bd52207626e38b08e51d
- SHA1 c20ec55c7f6e69181a35591ea3639d16013a8118
- SHA512 5646b6a4e421e2481d375ef19935436cfe59d0477af094e9f820c1c5838abc1cf8d42ce0fb63248db6693a881032ef958b451aa50bbc2cc1598ff8048cb5b184
- SSDEEP 196608:WYGt0La39CZhMTfhcIQeGZF6bUpMBF1p/kjRm4OWi2bfT:w7oZSKpIbUwF1VERmj2bb
- TLSH T17107CF12B2E40166D06A913ACB628635E7B17C2A8FB1C7DF2110B2DE1E737D17A36717
- MD5 SHA1 SHA512 SSDEEP TLSH