Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 00:08
Behavioral task
behavioral1
Sample
2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 12.6MB
- Sample260716-ae8nmsgx4n
- SHA256 28ca65ccca7354a9a570d7de36b8d021ea5d3a771b34a75f20e56b7d3f906577
- MD5 3e170bd4eb34ed5308125e461e548874
- SHA1 e80fdf356d7414f033497adf080007e178f1e71a
- SHA512 7dbd118b329aa69dd7705cda50d234b1453f960bfccd88bbac21579bcb167da8071e6d69f2a0652572b0a3427c09b332ddf1357c93e2596d316107b503ea40e8
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ065:ERXMzXdyZ/K0trFC4QR5
- TLSH T11AD69E13F2F44266D076C179CB925629EB713C5A4BB0C6CFA158B39C1E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001c0000000243fa-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001c0000000243fa-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\replace.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\write.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\printui.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/3644-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x001c0000000243fa-5.dat upx behavioral1/memory/3644-508-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/3644-3212-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.19041.1_none_a3224c6911783037\IMJPUEX.EXE- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\rwinsta.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\dstokenclean.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.19041.746_none_45062eb997366a7f\r\RemoteAppLifetimeManager.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\ScriptRunner.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.662_none_0070027dab4e4ffe\r\UtcDecoderHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.19041.746_none_59e1ce71631fef8f\f\WmsSelfHealingSvc.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\chgport.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\f\dllhost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\f\MsSpellCheckingHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_ad9c6c9be4203192\Netplwiz.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_216932a6d29366ce\relog.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_69061189792bce34\r\cmd.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.1_none_e1253388ca1ca1af\DismHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\uwfux.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1_none_e5e4ad7714f033ca\raserver.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\rdpinit.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\r\wordpad.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.19041.1_none_e2e6c013142b9760\OOBENetworkConnectionFlow.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.19041.1_none_1c5807cd8d0c767e\OptionalFeatures.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.19041.746_none_dbfd31e3890afb72\r\SensorDataService.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\rdpsign.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\wlrmdr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_6b184251474f0fac\w3wp.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.19041.1202_none_b9662ef4fe1412ad\r\OfflineScannerShell.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\LaunchTM.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.1266_none_c4b179e0b12fe4b9\f\winload.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\f\auditpol.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\r\csrss.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.19041.844_none_c606f47e6aa94b5b\r\hvsievaluator.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmLpac.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\f\schtasks.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\r\adamsync.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.19041.746_none_b7a67ddd8bcc7470\f\ApplicationFrameHost.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\f\lsass.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.19041.1202_none_5f774093e49b3593\refsutil.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\immersivetpmvscmgrsvr.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpinit.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_d1bc032a24676029\newdev.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVNice.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.1_none_484e61e96e69ac70\CameraBarcodeScannerPreview.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdge.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_6d3115c62c48462c\ftp.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\rasphone.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\r\appidcertstorecheck.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\r\SearchApp.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\r\autoconv.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\SystemResetPlatform.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\f\DeviceEnroller.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_10c2b4b34d346421\aspnet_regsql.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\f\pnputil.exe- 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_3e170bd4eb34ed5308125e461e548874_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 13.2MB
- SHA256 1c61047fe34f4addbeb10c779e32c63c8cc5061a83c613d877a5930d404910f0
- MD5 4b99e4d51377123b9a9ad6ab067fd767
- SHA1 c4d2f30d416a98f3b979690736f60e9244b275cc
- SHA512 78ce5ad8032e916694f647050c755c6e0ab7eef292720d7cafb6364d4fe1beeab66c09babd42729ee28ff1295fb669f2091a0a1a1c66a02c4892e6c13c03bd9b
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06pok:ERXMzXdyZ/K0trFC4QRmk
- TLSH T149D68E13F2F44266D076C179CA929629EB713C564BB0C6CF6158F3AC1E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH