Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 17:20
Behavioral task
behavioral1
Sample
2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 13.9MB
- Sample260708-vwglpsev8x
- SHA256 588faafd500a931ca7600b3ca9a749722b0d560290ecb0732963feba5bf82f12
- MD5 9b1864b63db549f6c82829f78af710cf
- SHA1 b20ab599d5fc9a99e1eba98f160f0da0a2468ae7
- SHA512 842f74c1ecae34f326be7c40f7ba1cc474fcef91d2a913812a8b322d5f2ba2168a5475da239309d49c48c0b271412a0db49953542c5defea6e874455f9188569
- SSDEEP 196608:NsPbHOAoXvvOKeGZF6bUpMBF1p/kjRm4OWi2bsPz:+OTTIbUwF1VERmj2bU
- TLSH T1ADE69D1A6EAC8762C47FBC748E55C684E1307C008721A99B2DC47F5DEA736D9793E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\find.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/2464-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001b859-5.dat upx behavioral2/memory/2464-380-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2464-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.26100.1301_none_1a384873cd299392\curl.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseGPParser.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\dvdplay.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\MoUsoCoreWorker.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-dw_b03f5f7f11d50a3a_10.0.26100.1_none_71dc1710cec228ac\dw20.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\r\bitsadmin.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\ReFsDedupSvc.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\r\rundll32.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\rmttpmvscmgrsvr.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15912.0_none_5cfe50bb9b6405ea\DataSvcUtil.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\CloudNotifications.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\r\mspaint.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\r\ofdeploy.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ROUTE.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UpdateNotificationMgr.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgrsvr.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_10714fc4b84d2612\stordiag.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15912.0_none_447f4612d8b724d2\AddInProcess32.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\r\GameInputSvc.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\rdrleakdiag.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1150_none_0ba6100513fbb80d\RMActivate_ssp.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\OfflineScannerShell.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.26100.1_none_493a1e7e2682a5b1\pipanel.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\readCloudDataSettings.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_5cdbf1a4c5f9fd2c\runas.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1150_none_0c04974f069bcd17\r\cliconfg.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1_none_34b3c72fc640281d\DismHost.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_0133b87cb28b767b\takeown.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\AssignedAccessGuard.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\telnet.exe- 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9b1864b63db549f6c82829f78af710cf_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.8MB
- SHA256 a9ef0625a4636097bd95e0056c0ef84164755a6590624da6d3997e70e2cc645b
- MD5 d1b792447165dacec3958907f9806ef3
- SHA1 89a7afe464bc4ea2da340fb38aa96b6e7da19f16
- SHA512 2e33d8607b8abff02d6f61aa8e4b04c16c1027018a62655eb80f3f6d34afa026dad84fe6d6ddfbef67af0197e341e3b9b6fca8d2cdee9e81db8fcf71942f3b48
- SSDEEP 196608:NsPbHOAoXvvOKeGZF6bUpMBF1p/kjRm4OWi2bsP/q:+OTTIbUwF1VERmj2b9
- TLSH T1CEF69D1ABEAC8322C47FB8748E95D685E5307C008721998B19C4BF5DEE736D5793E322
- MD5 SHA1 SHA512 SSDEEP TLSH