Analysis
- max time kernel
149s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 16:37
Behavioral task
behavioral1
Sample
2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.6MB
- Sample260709-t4za2sew21
- SHA256 4608479fe388e18670f75f4fcbd04fd6ff95e65ed37ca981a60bfc1319ece5cc
- MD5 b9d3fcf669eff86f5781647cc1a0db20
- SHA1 4313f1eb717daf157a0045a18b04cf0d7fedb51d
- SHA512 b7b6cc79f923030ab4c465f7777aa8d11eb4c42b8c32d5d2f3bb52f5cce853c51b0cd2c0c4eba6635af2d6f66b409fc3d2720e0d24ddd655497e2bc443d26efc
- SSDEEP 196608:ZsTfycI5P8o1Kmd0IgTH2qBpu1QfLIqsufc7dD:Or2Eq6THNBpu1Qfc0c
- TLSH T1CAF65A1272E54E99C05FD034CE025575A7233C4A8FB19BDF6940BEA93E366E07A3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024340-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000d000000024340-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\more.com 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\replace.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\write.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\user.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/2548-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000d000000024340-5.dat upx behavioral1/memory/2548-432-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2548-3212-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\f\wuauclt.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\AppVStreamingUX.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\msconfig.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\cleanmgr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\r\quickassist.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_76011176d90c065b\svchost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\ShellLauncherConfig.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\tracerpt.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_fef803c70cc0b37b\r\SettingSyncHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpksetup.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\r\wslconfig.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmimageworker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.19041.84_none_8a067925a612632c\r\ApproveChildRequest.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.19041.1_none_35f6aeed7d8158f9\setspn.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\winload.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.19041.423_none_edab5dd3a4c202d9\r\CredDialogHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmproxyd.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\f\msinfo32.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.1_none_4a852f698914a2f6\schtasks.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\f\FileExplorer.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_53219a572fef10a2\ctfmon.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\vds.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.19041.1_none_1673c4173fbf2169\tar.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\Magnify.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\powershell.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15805.0_none_74baba51266f3010\AddInProcess.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\pcalua.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_d6be4622df33d026\edpnotify.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\r\FileExplorer.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\f\WindowsActionDialog.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.1_none_753cc0191556f0a2\SecurityHealthSystray.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_b60bd945ca2276e4\IEChooser.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\f\SpeechRuntime.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_b92a768e22c5262b\vbc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\WerFaultSecure.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\r\CredentialEnrollmentManager.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.1151_none_329784a84ed43acd\wslhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\sppsvc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmBroker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\f\csrss.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.19041.1023_none_d3d892f3280079d7\f\MdmDiagnosticsTool.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_d1bc032a24676029\ndadmin.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1202_none_76e6fb38a70dbd6d\f\GameBarPresenceWriter.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_ac2441dbb712f006\r\msra.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.1_none_a4547e4c96be5f59\WMPDMC.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\f\WmsUserAgent.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_da504d0e6afd0a49\TsWpfWrp.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmmon32.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.1_none_2d2e881f7f8c5f63\CameraSettingsUIHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\tpmvscmgrsvr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpconfig.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\newdev.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2548
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 16.2MB
- SHA256 9d806df7c69fc495bb2bc8c580424c383fe36a4e5ade798c54fadf0a5514a457
- MD5 6ad8a5f8dbbabcf8e2e2efa3cdd7f48b
- SHA1 db542daab51d92f9460254ddf0a5326b59b6e903
- SHA512 e5b0fad2ea70c4807e21ea506562d27f9e2da61bdad5e018d0d5878150f06927b4e520e4d1b95f1f0e88191f4aca294e24f91c3a7dbfd4c75093511a703bd2eb
- SSDEEP 196608:ZsTfycI5P8o1Kmd0IgTH2qBpu1QfLIqsufc7dvoG:Or2Eq6THNBpu1Qfc0xG
- TLSH T116075A1272E54F99C05FD034CE425575A6233C4A8FB19BDF6940BEA83E366E07A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH