Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 06:33
Behavioral task
behavioral1
Sample
2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 16.2MB
- Sample260718-hbaanset61
- SHA256 547a10649ecff26cf338d1004c7fd62bef73e1c9e07a86911078f8b0b04f1862
- MD5 b970ae1e1455034b1cff7e84871ef919
- SHA1 e3c1162b4ffbd0c165747ffdfd12094870017b6a
- SHA512 04346809df24369438ee707db31b07bae90f7c7f067cb0b9460d2aff5c08b7194918506a88c6566e9e8875c9231d9f3548a02e89275f3a01fed1e315acf91859
- SSDEEP 393216:ERXMzI3yZ/K0ttYZTIfIbUwF1VERmj2b5E:ERXMzI3yZ/K0ttYZTIfIY092b5E
- TLSH T14C07C003F1A442A5D076D278CAA29626EB313C454BB095DF565CB3982F37AF0BB3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\format.com 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\control.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1244-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000800000001b83c-5.dat upx behavioral2/memory/1244-338-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1244-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\ClosePush.bat 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\RecoveryDrive.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\RestartAgent.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\wininit.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\r\ieUnatt.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\r\LsaIso.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1000_none_6715fee261171762\wevtutil.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\r\hh.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_cb7026b6ea62c346\whoami.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmmon32.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\wcsetupagent.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\rdpclip.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.26100.1_none_47c5cfc8c16dfb4a\scrcons.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_9493bccc1124c937\mshta.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\FESearchHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\MicrosoftEdgeBCHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\MuiUnattend.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\PickerHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_bd06c5e20c19d210\aspnet_compiler.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\r\vmplatformca.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1150_none_fba3bb9888bf82a5\r\CompPkgSrv.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\r\cttunesvr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_028d3f2f7abaac3f\PresentationFontCache.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\r\bridgeunattend.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_2dd1356526e6ef59\format.com- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_a8f2281169c44e9b\WMIC.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\r\BioIso.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\SysResetErr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-keyscan.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_231fe8bbbb362efd\IEExec.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\hh.exe 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\FsIso.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\TabTip.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\WmsSelfHealingSvc.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\ttdinject.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1_none_fc13383492b3e3d6\csvde.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpshell.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\ImagingDevices.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timezone-sync_31bf3856ad364e35_10.0.26100.1591_none_2af0eb0ad05bac33\tzsync.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\UtcDecoderHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\sdbinst.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_200ace4b24b1d248\chkntfs.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinprocess_b77a5c561934e089_4.0.15912.0_none_769e30e9239830f5\AddInProcess.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_2e87dc5d933c136a\reg.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-deployment-package_31bf3856ad364e35_10.0.26100.1_none_5bc14811ec1c13bc\TFTP.EXE- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1150_none_f9eb481555467227\r\WallpaperHost.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_651b8bd27b17ef87\where.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b970ae1e1455034b1cff7e84871ef919_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.1MB
- SHA256 608fde450ac2af27607e7c10001dfdca73809dc5c4014588e9b930aec585aa11
- MD5 387a6d724de36502a795e1220b229230
- SHA1 cbad3042c5a0a11ac00254f4cec8177d64355a66
- SHA512 445e2d60cd48e7b72aef89774f57c1bb2fca55aca851249d932f61befaa64dbb371015759934ee1cc2292bb100f21bb24e22d3c8805fb2b76814277d832ab8bf
- SSDEEP 393216:ERXMzI3yZ/K0ttYZTIfIbUwF1VERmj2b5j:ERXMzI3yZ/K0ttYZTIfIY092b5j
- TLSH T1AC07C003F1B442A5D076D178CAA29726EA323C454B7095DF5658B3A82F37AF0AB3D731
- MD5 SHA1 SHA512 SSDEEP TLSH