Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:13
Behavioral task
behavioral1
Sample
2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 15.7MB
- Sample260728-vrt18ssvay
- SHA256 5e98c9d71b8c382065bac515897389563c9c09824d447607866a509672ba2689
- MD5 70f09529dcc63426338edaf2f31670f0
- SHA1 4fc6fceae2cd02bde1a8b9a161bb336ee1ffb2a3
- SHA512 9b690013f94e9692eddb49a47e14703b783ae1e04e49409af6cf05243e0e7d00cbb45d88b7cb029b90dae374e1da42821676bd9d4a389d5b9f0c28f6f2d63f55
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6D:ShwZi32PVTfYocHOAoXvvOMob
- TLSH T11AF63807BE6CCD6AF87E39B5C844CA64D9287C145723355779E0BF5EA9732C23A28231
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000a000000019cc0-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000a000000019cc0-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fltMC.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\notepad.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\runonce.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tar.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\where.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wusa.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/4100-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000a000000019cc0-5.dat upx behavioral2/memory/4100-349-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4100-2921-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\r\winresume.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\r\LockApp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\RunLegacyCPLElevated.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\rstrui.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\OptionalFeatures.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1150_none_723b9016a5d6336f\printui.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\r\ReAgentc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\setup.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1150_none_c952c4f3d93cb420\r\DismHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_c435ce459c01d610\mscorsvw.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisreset.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\r\la57setup.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.26100.1_none_3b94e354cf3fab21\MSBuild.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ment-userdatasource_31bf3856ad364e35_10.0.26100.1150_none_01782765ebe4af77\r\UserDataSource.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_1f279d758fbcb0c0\msdtcvtr.bat- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\relog.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmstp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\RuntimeBroker.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_4ab0905276b69755\CheckNetIsolation.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\r\fixmapi.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\CustomShellHost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_c319a5f63c95aa27\vbc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\bthudtask.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\ApproveChildRequest.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1591_none_f3f0f30e057f293d\mstsc.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\bootsect.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_acc2fb65a486a112\aspnet_regsql.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_c8bf902cd831831a\CasPol.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingMasterScript.cmd- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\finger.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe- 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_70f09529dcc63426338edaf2f31670f0_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.7MB
- SHA256 72c3496d4d1a3a5871fcfd5875e480aa9f7399dd3df4c1c428f97516b818de7a
- MD5 fdca1532f0acc41fc230ba25f215af69
- SHA1 01a113da257a08fe374cd43c356896d20f7c93aa
- SHA512 08a803e31052d19b19eca80137c8759b5df67fc27e4f5b6eb531a3bba64d843b6857210498547b4da2c9d334baad2ccc5077fc8ee84ab0d16995bd5269688b5e
- SSDEEP 98304:OfkrRokxZaeUJF3noxDDu6/TIOSA6jo1MMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6t:ShwZi32PVTfYocHOAoXvvOMoH1
- TLSH T103073907BE7CCD6AE87E79B5C844CA65ED283C045723655779E0BF5DA9332C23A28231
- MD5 SHA1 SHA512 SSDEEP TLSH