Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 17:13
Behavioral task
behavioral1
Sample
2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 15.7MB
- Sample260728-vrt18ssvay
- SHA256 5e98c9d71b8c382065bac515897389563c9c09824d447607866a509672ba2689
- MD5 70f09529dcc63426338edaf2f31670f0
- SHA1 4fc6fceae2cd02bde1a8b9a161bb336ee1ffb2a3
- SHA512 9b690013f94e9692eddb49a47e14703b783ae1e04e49409af6cf05243e0e7d00cbb45d88b7cb029b90dae374e1da42821676bd9d4a389d5b9f0c28f6f2d63f55
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6D:ShwZi32PVTfYocHOAoXvvOMob
- TLSH T11AF63807BE6CCD6AF87E39B5C844CA64D9287C145723355779E0BF5EA9732C23A28231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024545-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0008000000024545-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkntfs.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral1/memory/4828-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0008000000024545-5.dat upx behavioral1/memory/4828-348-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4828-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.844_none_77a5d9aafae08e77\f\MDMAppInstaller.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\f\Win32WebViewHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\r\memtest.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_956906931b26e27a\winrshost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.19041.1_none_3626754ec37c229b\RmClient.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\r\fixmapi.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\f\raserver.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.746_none_c05346ae3e1a99a4\r\rundll32.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\rasautou.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\f\sxstrace.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_0d475c3f57a2ce2b\at.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_5163f0069562aff6\r\powershell.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\f\WerFault.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.19041.1_none_5d169326bbc0abdb\upfc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_d848cc62b1883bca\f\cttunesvr.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\fltMC.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.19041.1_none_efd4c696d660bdad\vbc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\r\ndadmin.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.19041.844_none_de5d9fe254d9f8c4\r\BioEnrollmentHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.1_none_0ed4f15b837334c7\csrss.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.19041.1_none_258f6f31a16a0eac\DevicePairingWizard.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\r\gpscript.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\WWAHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\winresume.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\f\InputSwitchToastHandler.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.264_none_de5e254ba7caf399\r\tcblaunch.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\f\PerceptionSimulationService.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.1_none_6905f2230c3224a7\djoin.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.1_none_c653cc0f2ac29042\WmiPrvSE.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\r\relog.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.19041.1_none_cc9bf4448d8f2bf4\regini.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\r\ByteCodeGenerator.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.19041.1_none_dc058eb644f1f90b\bfsvc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\relog.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\r\appcmd.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\ofdeploy.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\r\VmComputeAgent.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_737d8b2eaaa38234\r\DWWIN.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_0f8992295edbadb4\eudcedit.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.1_none_b0feb06b14107c04\wecutil.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\f\vds.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.1_none_7c197eeaa6d7861f\SndVol.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\lpkinstall.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\r\iexplore.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.19041.1_none_b0df27a8cf08799e\LinqWebConfig.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\r\vmcompute.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\cscript.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\r\WWAHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.19041.1_none_9561617494f4801d\NETFXSBS10.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\CustomShellHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_87b4b95ab967b582\f\fontdrvhost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\f\icsunattend.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 16.3MB
- SHA256 6fecb15e9289a965af33145e2f0e1e7a3b7b189ee368a3a08cdd914467963e8a
- MD5 bab8b7523fd0472ba33f88ef02db67ad
- SHA1 7ed7c9d49d32868d2b0cba481bc23c6f4b9933f2
- SHA512 ab534a2a4187392bf1d410fa952bf40b415871a5aba6381e57f14d35e54e780616b5f7a6ab273cd42c1d46eb7d75d5a2e5cc9fd26e12fa1d350604bc79e70d1c
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM66:ShwZi32PVTfYocHOAoXvvOMo3oD
- TLSH T169073807BE6CCD6AF87E39B5C844CA64D9287C045723755779E0BF5EA9732C23A28231
- MD5 SHA1 SHA512 SSDEEP TLSH