Analysis
- max time kernel
150s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:33
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 12.7MB
- Sample260808-awj2lsweqf
- SHA256 fc06a52418f50d496bc8484cf03f6df581f45dcf083ed25cab35267bb9310c00
- MD5 dd65316209ad4d2aab3027b63d9a490d
- SHA1 c481ff78b9af4c5bdc8b5e5a8462fe2518dc7d2b
- SHA512 2a95420f8b7c16db44d74aec07b056b26b96bafe36077e82a52d0e5c01b28443fd39df6bc408831fcf25ff3959cb9a774da85d538adaa9ebfb225b4322f07388
- SSDEEP 98304:7fkZcAjkolXXu/3NETIOSAuKUgTH2M2m9UMpu1QfLczqssnKSgfkZc9:zPekwe1ETf6gTH2qBpu1QfLIqsuf+P9
- TLSH T13ED6391262D8CFEAD06F9074CD567AB566223C558F218FCB2D40BE293D317E15A3622F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c4e0-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c4e0-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msra.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\format.com- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mode.com 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\more.com- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_c055032b96806f80\wscadminui.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\poqexec.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCLNWZ.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\r\AppHostRegistrationVerifier.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1_none_df337d63f8ff3ba4\iscsicpl.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\r\msinfo32.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\r\sethc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.26100.1_none_0c15b158e639a4e7\icsunattend.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.26100.1150_none_2bd28325d6e61084\dsamain.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\r\dasHost.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\refsutil.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\services.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\LogonWebHostProduct.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.26100.1_none_97b37ed8879d1c57\MSBuild.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_217b48412b560e3f\aspnet_wp.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\rmttpmvscmgrsvr.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\unlodctr.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateBaselineGenerator.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\r\ReAgentc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.26100.1_none_dc63fc515e239427\NETFXSBS10.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_4e3bd09ff189ac9a\aspnet_wp.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.26100.1_none_ded6253deae5fdf0\dnscacheugc.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\r\msinfo32.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\RunLegacyCPLElevated.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\LaunchTM.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\iissetup.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\wextract.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\mpnotify.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\diskperf.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_0133b87cb28b767b\takeown.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_dd65316209ad4d2aab3027b63d9a490d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.6MB
- SHA256 7d47a201171ff5c211953b332761e8a30fad1bab40036b0bc09d7575e3ec7711
- MD5 36d27fa201ad7c3f8bdfcc55cf30e71f
- SHA1 7d744f95d56617d7a199a59a8930395a83c53eaa
- SHA512 336ac3524adeecebad0cc1be5b85676780a8ccaa35f0b74462a7b5177a2129b17d4528f200c8c29ebc0a0800e6b0f4d9afbe74e210957017b750c3f225daaae5
- SSDEEP 98304:7fkZcAjkolXXu/3NETIOSAuKUgTH2M2m9UMpu1QfLczqssnKSgfkZciezSC6v2XI:zPekwe1ETf6gTH2qBpu1QfLIqsuf+PJI
- TLSH T1E8E63B1162E8CBEAD06F9074CD567AB565233C558F218FCF2940BE293D317E19A3622F
- MD5 SHA1 SHA512 SSDEEP TLSH