Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 09:11
Behavioral task
behavioral1
Sample
2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.0MB
- Sample260720-k5sp8afs7x
- SHA256 52be9381b35bdcde181b8398d3e3eb4783d47b3d19ee9cfd7f7c6fcf1ae93e8a
- MD5 9f0cb4415f2aa46306ce11f36e8f8fed
- SHA1 0c6cd42de73646b6ea6cae8152ec32147bf54834
- SHA512 ac5ba7dd03134cd704262575b0b9be717290cfe37f13257535dca03e920a0c736e6124ec144106e4b6cd1530de3b835c30417b0f43e0b3e782ad02a10884e5e5
- SSDEEP 196608:WYGt0La39CZhQPjTfleGZF6bUpMBF1p/kjRm4OWi2bpds:w7oZwBIbUwF1VERmj2bM
- TLSH T138F6D012B3E84566E07B923AC5728A39E771782A4F31C6CF2150B65E1E737D18E36723
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c538-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c538-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntprint.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\find.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\newdev.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runas.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wusa.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regini.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/4340-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c538-5.dat upx behavioral2/memory/4340-344-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4340-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.26100.1742_none_8907e35eb88d8d7f\convertvhd.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\r\CheckNetIsolation.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_39fcf1c342e78ddb\icacls.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Boot\DVD\PCAT\etfsboot.com- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\uwfservicingscr.scr- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\r\dccw.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\r\RMActivate_isv.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_3b8c278ba0146cc8\tzutil.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\r\mofcomp.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..oreuap-iotuap-tools_31bf3856ad364e35_10.0.26100.1150_none_c74b9bded5451f89\r\iotstartup.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_b800bbe6c459021b\csc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\r\upnpcont.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\r\fixmapi.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\r\SpeechRuntime.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_edc32a46d1cb7363\makecab.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\r\WpcMon.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\rmttpmvscmgrsvr.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseTVM.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-setspn_31bf3856ad364e35_10.0.26100.1_none_7cf949ca46b06d03\setspn.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.26100.1_none_ff9d2f602c1cc7f1\sapisvr.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.26100.1_none_baccdf245b7274cb\cttune.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1_none_6abdc3ad5e5ae2d2\RdpSaProxy.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.26100.1591_none_a08d59ccf9531fab\icsunattend.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.26100.1_none_2122cf9edbab3972\dmcfghost.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\r\ReFsDedupSvc.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\UCConfigTask.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\r\UserAccountControlSettings.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\splwow64.exe 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.26100.1_none_9de52fbbd18a142f\BdeHdCfg.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUxStub.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\PickerHost.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\r\ctfmon.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\r\TokenBrokerCookies.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\diskperf.exe- 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_9f0cb4415f2aa46306ce11f36e8f8fed_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.0MB
- SHA256 6f82fd0a2d6decfecb9425fb5c3bcccc7f8563b35219ae3e9fbb32253a545930
- MD5 479a8efbe3b55c98faf168a69c64d874
- SHA1 71221b5393a43147d9d89b0495f15b684436aed3
- SHA512 61849ee523d1c83a6d1151898d7096c2c806a3c01e55af1b49c60a9fbf70cac0a7bba6df09b86df3115b4bc8b2bc9e8b64c392a5ed4ce272da82bf78a35f55b3
- SSDEEP 196608:WYGt0La39CZhQPjTfleGZF6bUpMBF1p/kjRm4OWi2bpdCK:w7oZwBIbUwF1VERmj2bR
- TLSH T11EF6D012B3F84266E07BC17AC5B28A79FB7178164F31C6CF2150A65E1E737D18A36722
- MD5 SHA1 SHA512 SSDEEP TLSH