Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 01:56
Behavioral task
behavioral1
Sample
2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 14.9MB
- Sample260720-cc2tesex2w
- SHA256 2f6c2a2dfca26aed7c5cdab183548c59d54ca41a4e530e0953037d7e3ba866c9
- MD5 0380c2f6de3ec49f8e6548d7df698c68
- SHA1 3be98c2a40fd1a3661c83d6017a240ab89642ca8
- SHA512 4fa060bcbbc9bed09ef240ade11ced3c18a8b79783647542902753b0a4468f26e318b7cf2bde8cc711bd24928b178a5c22fbb32edac0e6d9ee7afa1f08a4f414
- SSDEEP 196608:ZaHxXMZ6+oYTfYeGZF6bUpMBF1p/kjRm4OWi2b56EoB:ERXMo5UkIbUwF1VERmj2bI7B
- TLSH T1DDF6BF03F293891BE1A5D239C461853592713B7E87B385EFFC1CB19CEA3B2936525B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0004000000023208-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0004000000023208-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mode.com- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\attrib.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\curl.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sc.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral1/memory/456-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0004000000023208-5.dat upx behavioral1/memory/456-462-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/456-3220-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_c42bf1ebf80a8661\f\isoburn.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\r\lpremove.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.19041.1_none_bf4cc5bb201caae3\powercfg.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.19041.1_none_3eb167e4f0e920b5\curl.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\r\FileExplorer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\r\FileExplorer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\f\wmpconfig.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmplayer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.19041.1_none_cffda9bf5435db63\mcbuilder.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\r\NarratorQuickStart.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_abd26b7610cb738e\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmmon32.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\r\wbengine.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.746_none_4028b8f4f6c0b829\wpr.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\appcmd.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_e51212a36c631d23\CasPol.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.1_none_cf7ec085c4b5345c\fltMC.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\f\AtBroker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\f\powershell.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-write_31bf3856ad364e35_10.0.19041.1_none_1fc88a05b0d625c5\write.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\poqexec.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_95a8887a13522472\eventcreate.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_8b2066136dd02eb6\TiWorker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\ApplyTrustOffline.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\WWAHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\r\SpeechRuntime.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\f\SrTasks.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.19041.1_none_f2fa56e679b879d1\icacls.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.19041.1_none_55cbbe2f0b32a503\credwiz.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.1_none_f53047daaa565a5e\dllhost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\r\PerceptionSimulationService.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\Defrag.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\MBR2GPT.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1_none_6f2c92b5bf3d99bc\Taskmgr.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\CertEnrollCtrl.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchIndexer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\Setup.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchIndexer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\f\eshell.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.1081_none_955497efbb030cb9\f\wermgr.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_c76758d7f0069e2e\newdev.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.746_none_b6b8620636970859\f\PerceptionSimulationService.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1_none_9a8a77811e17322b\LsaIso.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vdsldr.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\typeperf.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\hvix64.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\r\bcdedit.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_d9b4a5b5fd217f4b\dxdiag.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 15.4MB
- SHA256 a0b0e699d9dee70308a23b60e904f2efebc2dfc5b083eef3ace0677fa1922cdb
- MD5 2577467164b995add6bfce0321644763
- SHA1 a5735b3cf35d0dd9f027da65d38eac423552fd66
- SHA512 e6b680b057412b5b3caa72fc6c59542293e830937473788c9f421e95d1288c47393062786a213740ded9320b836306e9d523489377d17f4fe4bf699a6aac53fc
- SSDEEP 196608:ZaHxXMZ6+oYTfYeGZF6bUpMBF1p/kjRm4OWi2b56EoBoQ:ERXMo5UkIbUwF1VERmj2bI7+Q
- TLSH T18EF6BF03F2938917E1A5D139C4618635D2313B7E87B385EFBC5CB19CEA3B2A35529B12
- MD5 SHA1 SHA512 SSDEEP TLSH