Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 06:33
Behavioral task
behavioral1
Sample
2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 16.2MB
- Sample260718-hbaanset61
- SHA256 547a10649ecff26cf338d1004c7fd62bef73e1c9e07a86911078f8b0b04f1862
- MD5 b970ae1e1455034b1cff7e84871ef919
- SHA1 e3c1162b4ffbd0c165747ffdfd12094870017b6a
- SHA512 04346809df24369438ee707db31b07bae90f7c7f067cb0b9460d2aff5c08b7194918506a88c6566e9e8875c9231d9f3548a02e89275f3a01fed1e315acf91859
- SSDEEP 393216:ERXMzI3yZ/K0ttYZTIfIbUwF1VERmj2b5E:ERXMzI3yZ/K0ttYZTIfIY092b5E
- TLSH T14C07C003F1A442A5D076D278CAA29626EB313C454BB095DF565CB3982F37AF0BB3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\calc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\calc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\comp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tree.com 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winver.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sort.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/440-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00060000000231d3-5.dat upx behavioral1/memory/440-428-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/440-3216-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvax64.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.19041.1_none_6a9f2a3a3265ab31\nfsadmin.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\r\TokenBrokerCookies.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXLauncher.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_6e05a6bb2291b4c6\IMESEARCH.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_bf6140efbe1a7808\csc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\CustomInstallExec.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.1_none_26e3edd6087852fc\backgroundTaskHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_62dc6b73f7e78431\ftp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\subst.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_1bb0d4ac7da3bfe1\ngentask.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_f07d4fae3e8e883f\IMEPADSV.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\r\DisplaySwitch.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_23c0aa3b7bd960cd\r\CheckNetIsolation.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\logman.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\pnputil.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\f\smss.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.264_none_8be8c2693dde2cd4\TokenBrokerCookies.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.264_none_13222f28beaa00a7\r\vmwp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\control.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.1_none_a2b2be7cc3d8faf5\DisplaySwitch.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\f\CallingShellApp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.1_none_4a6487592c595dd4\mpnotify.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\backgroundTaskHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_19de3c7b933c6faf\eudcedit.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\poqexec.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.19041.746_none_744cb37f06e446cc\f\RuntimeBroker.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\lpkinstall.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\r\bdeunlock.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\WmsUserAgent.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\f\ByteCodeGenerator.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\f\explorer.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\r\LockApp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\OOBENetworkCaptivePortal.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\SpatialAudioLicenseSrv.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c4e6302d398f7e04\mscorsvw.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpshare.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\WMIADAP.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_0bff5a051c4a690a\XamlViewer_v0300.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\MuiUnattend.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_38869341091832be\f\mofcomp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\r\BitLockerWizard.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\f\MusNotificationUx.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\ndadmin.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_556ba5d1df8130ac\f\printui.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\MusNotifyIcon.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\HOSTNAME.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-unlock_31bf3856ad364e35_10.0.19041.746_none_428efbd28b482d1c\f\bdeunlock.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_0e4d25c8cb52f8d0\WFServicesReg.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\rundll32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\f\IcsEntitlementHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\HvsiSettingsWorker.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_330dfb2b06b21af6\print.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:440
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 16.7MB
- SHA256 046a056d764ff5e055648af561b1a996a7ee6cbde49d21515b65fb770377ddcf
- MD5 1d528935aeb7f510eb5c19ebec39c050
- SHA1 90c72e0836369bc59e5111eb323c061abfefe445
- SHA512 24be9fbfbc692583bb870c04dbb12248220b30770f9f6b9b64a0de489657b4412ca28b8565edde85917ef90942e8570ad54690d12ea32fc9c2bba0184626f779
- SSDEEP 393216:ERXMzI3yZ/K0ttYZTIfIbUwF1VERmj2b5p+:ERXMzI3yZ/K0ttYZTIfIY092b5p+
- TLSH T1DA07C003F1A442A5D076D178CAA29726EB313C454BB095DF565CB3A82F37AF0AB3D721
- MD5 SHA1 SHA512 SSDEEP TLSH