Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:37
Behavioral task
behavioral1
Sample
2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.6MB
- Sample260709-t4za2sew21
- SHA256 4608479fe388e18670f75f4fcbd04fd6ff95e65ed37ca981a60bfc1319ece5cc
- MD5 b9d3fcf669eff86f5781647cc1a0db20
- SHA1 4313f1eb717daf157a0045a18b04cf0d7fedb51d
- SHA512 b7b6cc79f923030ab4c465f7777aa8d11eb4c42b8c32d5d2f3bb52f5cce853c51b0cd2c0c4eba6635af2d6f66b409fc3d2720e0d24ddd655497e2bc443d26efc
- SSDEEP 196608:ZsTfycI5P8o1Kmd0IgTH2qBpu1QfLIqsufc7dD:Or2Eq6THNBpu1Qfc0c
- TLSH T1CAF65A1272E54E99C05FD034CE025575A7233C4A8FB19BDF6940BEA93E366E07A3921F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c588-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c588-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fontview.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mshta.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ftp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cacls.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmd.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/428-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c588-5.dat upx behavioral2/memory/428-365-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/428-2918-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8D765FE5-66FD-458B-8914-BB4A967D051A}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wab.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\r\IMJPSET.EXE- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1150_none_3cdcbfd9e162066d\RMActivate.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\finger.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\r\gpresult.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.26100.1_none_0142444d3857c993\dplaysvr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\ttdinject.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\r\msinfo32.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\r\msinfo32.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1_none_d11476bef5cb0aeb\msfeedssync.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.26100.1591_none_72c54a0c20f4219b\AxInstUI.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\NDKPing.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\CompatTelRunner.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\RMActivate_isv.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_3d9ee4c539dc092a\ddodiag.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_67ad1b14943183e5\netbtugc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\r\RMActivate_ssp_isv.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_bbcf7a15a36f8b3f\runonce.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.26100.1_none_c842a966f62dd0c5\FirstLogonAnim.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.26100.1_none_2cc651b7f8fde87f\taskkill.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\HelpPane.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\LockApp.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsv.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\r\RuntimeBroker.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\rstrui.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.26100.1591_none_1754f2ff6760d03e\WinSAT.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\r\diskpart.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_f6d6d78e8be62381\wlanext.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_b800bbe6c459021b\csc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_36d761739f8fd1b7\vbc.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1_none_5459e3b4a959687e\bitsadmin.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\colorcpl.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_c32f23e8b061a8a0\verclsid.exe- 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_b9d3fcf669eff86f5781647cc1a0db20_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.6MB
- SHA256 dcd163b12ded9bacc5a254b7790aef2f4767fdab3d37dbc35b06340ae4ab24f0
- MD5 9a90725a9823eb1215adb8152f847bbb
- SHA1 09389ea0724852899e938d39186a04b884172077
- SHA512 5bae41a14ed9ca453cf8c0a6960e1c2b7e74492eb996b8be5c4d19d64249b9ed82ac962c1d872b007e3741c1651f24cbdc530941e87596d0796bf0170793384b
- SSDEEP 196608:ZsTfycI5P8o1Kmd0IgTH2qBpu1QfLIqsufc7dvo:Or2Eq6THNBpu1Qfc0j
- TLSH T109075A1271E54B99C06FD034CE426575A6323C4A8FB19BDF6540BEA83E366E07A3931F
- MD5 SHA1 SHA512 SSDEEP TLSH