Analysis
- max time kernel
150s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 05:33
Behavioral task
behavioral1
Sample
2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 18.1MB
- Sample260730-f83blstyhy
- SHA256 db7649be0da24f874b0bb939718e13c2027121f425ad6644b203cd16aad0c961
- MD5 6938050508aa07b0696518058ba8ca23
- SHA1 4f55f1d990fe20c92be2281841e245cb6a272ecd
- SHA512 adf22fbc4b9e12dcad5de08e93c35e3fc9bbe0aba8af4f15c6fdedfb50d95619fb5d4de793749419f1b7b5730102bdb4c0f62f05a2be7d38926ec3633b8e71f6
- SSDEEP 393216:ERXMziJIbUwF1VERmj2byIbUwF1VERmj2bS:ERXMziJIY092byIY092bS
- TLSH T12C17F103F2D40166E06A933E8072493996717C2A5B35C6CFE96CB51E9D7B7E18A3E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c453-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c453-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrs.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mode.com- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmd.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\newdev.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/472-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000f00000001c453-5.dat upx behavioral2/memory/472-326-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/472-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\scrnsave.scr- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\AppInstallerBackgroundUpdate.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\RuntimeBroker.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmimageworker.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_c435ce459c01d610\mscorsvw.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\r\Dism.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\r\OpenWith.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\TCPSVCS.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\WSManHTTPConfig.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseAP.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\typeperf.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\reset.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsv.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\FESearchHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\colorcpl.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\PickerHost.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\TieringEngineService.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\PhotoScreensaver.scr- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\HelpPane.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\servicing\TrustedInstaller.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\HOSTNAME.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_c319a5f63c95aa27\vbc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\r\vssadmin.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\HOSTNAME.EXE- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmbind.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\r\hvsiproxyapp.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1_none_dc9627270e16a6e8\ReAgentc.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\ApplyTrustOffline.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_0f19119bcdcaf335\r\SpeechModelDownload.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6938050508aa07b0696518058ba8ca23_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 19.1MB
- SHA256 defce9cd5bf884b5e78489c2831c34c9bad77b1987c8935b68f5680e713f4768
- MD5 e2e138b4e47b47dc79f3d0ca7abcde0b
- SHA1 a903513ac80076e3fa151a5d95f53dc8f797e2a6
- SHA512 6be1973301c5f643ccb560913fb560f2c6005d29d77bea1d9d410098ce5ef7ff78f9b4ed69e51b487cedb93510a8d66109103a1190c5dea12bd7d03fbf3cdf30
- SSDEEP 393216:ERXMziJIbUwF1VERmj2byIbUwF1VERmj2b2:ERXMziJIY092byIY092b2
- TLSH T1DC17F102F2E40166E07A933EC0A25939E6717C265B31C6CFE96CB61D5D777E1893E322
- MD5 SHA1 SHA512 SSDEEP TLSH