Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 18:13
Behavioral task
behavioral1
Sample
2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 17.3MB
- Sample260722-wt38csen7y
- SHA256 882f69da1d2ef1975e7544d04eec0bcbbdef50686e3c8677f79bd97f07cbf111
- MD5 12ec96cc1a073abecfde580b2ccba696
- SHA1 a7538c3fc6b6a375b3339c8dca59cb01c98f1489
- SHA512 38593bab6589e840c03fb62807609ff7fd513da73fe905e735bfad1f3e14c3647eacb368b49bd2ea9f2ce81ab183ccf08858c109f270a57a69e7051d30228bc6
- SSDEEP 196608:ShwZi32PVTfIPTgTH2qBpu1QfLIqsufjd4:Syo6FTHNBpu1Qfc0m
- TLSH T1CF072A026DACDEA9E46F78B4CC4595B05D263C054E227ADB79D0BF2DB9321D07A3813B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001b922-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000b00000001b922-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\replace.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winver.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\curl.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\at.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fc.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netsh.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/3956-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000b00000001b922-5.dat upx behavioral2/memory/3956-329-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3956-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\7z.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\UsoClient.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\LaunchWinApp.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_697667281e7cce2c\AppLaunch.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\PhotoScreensaver.scr- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\r\LaunchWinApp.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\WindowsUpdateElevatedInstaller.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\reset.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuauclt.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\audit.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.26100.1150_none_5cbb86162cb9f00b\wevtutil.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_068e99c8dd0d8394\aspnet_wp.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\iexpress.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15912.0_none_fcd20f3bc43afbcc\AddInProcess32.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\rekeywiz.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\iisrstas.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\r\osk.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.26100.1591_none_c6e1de18243de2ea\edpnotify.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-utilityvm-setupagent_31bf3856ad364e35_10.0.26100.1150_none_b58f8d0d75fe71dd\r\wcsetupagent.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.26100.1150_none_2e44a4dc7ef60e78\CameraBarcodeScannerPreview.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\relog.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\rwinsta.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\mavinject.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmplayer.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\RMActivate_isv.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\CredentialUIBroker.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_39fcf1c342e78ddb\icacls.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\sethc.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.26100.1_none_2e6b5339c0dc1a38\TSWbPrxy.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\Win32WebViewHost.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1_none_0255f59a11a05209\wecutil.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_bd06c5e20c19d210\aspnet_compiler.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.26100.1_none_25d9db2c4f37e5a9\MdRes.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\r\wbemtest.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\r\OpenWith.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\BrowserCore\BrowserCore.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\r\CCG.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.26100.1_none_f7e1c28598378da8\LinqWebConfig.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\r\hvsievaluator.exe- 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_12ec96cc1a073abecfde580b2ccba696_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 18.2MB
- SHA256 54a047c991104ba6e96e9df8eff862eb9f8209cc146477e48866fccf06a73215
- MD5 0fccd3fea98e9c0d7acd80ce50dfa08d
- SHA1 ba97e922cc9ba4c3d208e202f959da353ac023f8
- SHA512 96f79394adfebcab7cfb7e749da568635c4e412f4399f66365250429517792555fba0702b47d883603757dbdaeb36c70278fe0041f8b50985ae06cb76f4288cf
- SSDEEP 196608:ShwZi32PVTfIPTgTH2qBpu1QfLIqsufjd++:Syo6FTHNBpu1Qfc0j
- TLSH T141172A026DACDF6AE46F78B4CC4595B05D263C054F226ADB7990BF2D79321D07A3823B
- MD5 SHA1 SHA512 SSDEEP TLSH