Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 01:56
Behavioral task
behavioral1
Sample
2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 14.9MB
- Sample260720-cc2tesex2w
- SHA256 2f6c2a2dfca26aed7c5cdab183548c59d54ca41a4e530e0953037d7e3ba866c9
- MD5 0380c2f6de3ec49f8e6548d7df698c68
- SHA1 3be98c2a40fd1a3661c83d6017a240ab89642ca8
- SHA512 4fa060bcbbc9bed09ef240ade11ced3c18a8b79783647542902753b0a4468f26e318b7cf2bde8cc711bd24928b178a5c22fbb32edac0e6d9ee7afa1f08a4f414
- SSDEEP 196608:ZaHxXMZ6+oYTfYeGZF6bUpMBF1p/kjRm4OWi2b56EoB:ERXMo5UkIbUwF1VERmj2bI7B
- TLSH T1DDF6BF03F293891BE1A5D239C461853592713B7E87B385EFFC1CB19CEA3B2936525B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001af5c-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001af5c-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\svchost.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\notepad.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\calc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1348-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001af5c-5.dat upx behavioral2/memory/1348-368-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1348-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_2fa847710e86cbe0\icacls.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\cmdkey.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\r\verifier.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.26100.1_none_55d78c384ca248d1\csrss.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.26100.1_none_ea4a5d2678ee83a1\Netplwiz.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\ResetEngine.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\msinfo32.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-keygen.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\IMCCPHR.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ROUTE.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_5da5aa85f914f74d\srdelayed.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\notepad.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\r\PasswordOnWakeSettingFlyout.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.26100.1_none_ca6f6ae66cca19d0\NetHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPUEX.EXE- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\r\BrowserCore.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.712_none_95c89fce0cf184aa\RMActivate_isv.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\r\spaceutil.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\ShellHost.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\dialer.exe- 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_0380c2f6de3ec49f8e6548d7df698c68_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.8MB
- SHA256 67d8e60875756787b21d86101325695a9535702f961b9d2d75b41bf154b1023c
- MD5 69eccf9127c5f8f7ef2df14c7d591e08
- SHA1 bf33967ff0b952b378a62f7b72f9836a8c204216
- SHA512 75cfe7a704fb425768d996856bc1d836ad2171d810e4a4c8dedc77f0ce04bc78d98452b969392a750f2e03d3d2667644a5df2ee04ca3069e8e8294b6a490ca74
- SSDEEP 196608:ZaHxXMZ6+oYTfYeGZF6bUpMBF1p/kjRm4OWi2b56Eo9S:ERXMo5UkIbUwF1VERmj2bI7w
- TLSH T16FF6BF03F2A38617E1A5D139C4618635E6313B7E877385EFB81CB19CEA3B2A35535B12
- MD5 SHA1 SHA512 SSDEEP TLSH