Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 21:14
Behavioral task
behavioral1
Sample
2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 17.3MB
- Sample260724-z3d7datckf
- SHA256 741cd81671296fcd60ae52283fe439c8e34f209c4a8ab54d986d9d363c986830
- MD5 2e31ac6b81f7fdb1578497b6c8bccf16
- SHA1 74c8d1f010d748b3f8b9aec2de50b26e68562715
- SHA512 e735bf42d94e557cbc4208fe1b60686b664bac9b8022804401fb2879a0ea11d0e639de0c191544664b2f37b031f85c817cddd2be4367fdb503ba50673dae8ad1
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6m:ShwZi32PVTfYoDjrOOwH+vv
- TLSH T1870729027DA8DEA9E86F78B0CC4595B14D1A3C155E227ADB79E0BF1DB9321D03A3413B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c718-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c718-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RmClient.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\label.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systray.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\subst.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\choice.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\format.com 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\where.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net1.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/6932-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c718-5.dat upx behavioral2/memory/6932-308-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/6932-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\r\PresentationHost.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\r\psr.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-drivepreparation_31bf3856ad364e35_10.0.26100.1_none_9de52fbbd18a142f\BdeHdCfg.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_602c21c18baf8b7f\aspnet_wp.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\hvsievaluator.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\HvsiSettingsWorker.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1_none_5459e3b4a959687e\bitsadmin.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1_none_0dbef45e6036c735\ComputerDefaults.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\ApplicationFrameHost.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1_none_36c64bb72fffb46a\Dism.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\winrm.cmd- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\dsmgmt.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\r\NgcIso.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.26100.1_none_603d466a5482ab50\Register-CimProvider.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\regedit.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\r\msoobe.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\r\CompatTelRunner.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\r\cttunesvr.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_6afaa980b9711021\SystemPropertiesProtection.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\BrowserCore\BrowserCore.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAgentPolicyGenerator.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnphotplugui_31bf3856ad364e35_10.0.26100.1150_none_84c881fffaa85756\DeviceEject.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\scrnsave.scr- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\PasswordOnWakeSettingFlyout.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\DWWIN.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmbind.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\PrintIsolationHost.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmBroker.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1_none_b45ed20d4205ffbb\cipher.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\r\wextract.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\r\wmprph.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_5c657b87715a8e52\aspnet_regbrowsers.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1_none_1d7ec919ce94ac2f\winrshost.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.26100.1_none_ff9d2f602c1cc7f1\sapisvr.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\r\IMESEARCH.EXE- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\esentutl.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_5da5aa85f914f74d\srdelayed.exe- 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_2e31ac6b81f7fdb1578497b6c8bccf16_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 18.3MB
- SHA256 40b2ec13e5bee331c492d11d47dc1eeff86e7c8bfebe9e31df0d6a2d03ca4c50
- MD5 569ee03af706fcdd20b8ea068c4c7141
- SHA1 eb9e7002f461eba4638a164a38e1a4a3a1b4b7eb
- SHA512 02e7166ae17d0c4d78f7085a99811f11ace05fb1afdcd8a6a70abeeca73fa20666474ddaefe4c9b7fca16cd24e3b871266bdaa40a59f949ef109c1a6edbba1f6
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6j:ShwZi32PVTfYoDjrOOwH+vr6
- TLSH T11F172A027DA8CFAAE86F78B0CC4595B15D263C055E226ADB79D0BF1D79321D07A3423B
- MD5 SHA1 SHA512 SSDEEP TLSH