Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 01:15
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
- Size 4.3MB
- Sample260808-bmgessba44
- SHA256 d0979ded2933dbe71f79630bf16229becba595ee36d8fbec684fbc9549bdcb91
- MD5 683a0cdb7070602155aa9f1944ec5831
- SHA1 49b2522bff4195cfdcb78e88c82b35e49f53d340
- SHA512 56bbd45557ffa07806910dbcdb954d75628ee5b60e0c9fa3e2556593fd28f6bac63d45ab93f83a8782df2b0814fda4eae40aaeee6899354582875641b8cf9f09
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj0p:7fkZcX6zTIOSAX
- TLSH T1E7266D12B3F88637E0BA927EC0B1597DE771742B9B32C78F3104AA5D5D677828526323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0006000000023216-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0006000000023216-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.867_none_9fcce199936290f4\f\upnpcont.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15805.0_none_6d5f51303f9aca21\SMSvcHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\f\DWWIN.EXE- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.19041.1_none_825521fc8f4a22ac\fsutil.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.84_none_3e82ed1fe15c67db\f\rstrui.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\f\WMIADAP.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.1_none_ebe59bdc3d4ddc3f\FlashUtil_ActiveX.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.19041.1_none_9d2d2a9ab0964bc3\cmdkey.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\wmpconfig.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.19041.1_none_20798db5235046f8\provlaunch.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\r\MoUsoCoreWorker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\f\SearchProtocolHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1023_none_374973298940e35c\f\FilePicker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.19041.746_none_ff3f6c27e956149f\r\LanguageComponentsInstallerComHandler.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\f\ssh-keyscan.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_75cabfc3071adb42\certutil.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_d7cac98c90803a6a\auditpol.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_9972edde9b98690c\wscadminui.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\XBox.TCUI.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\r\sdchange.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\DeviceEnroller.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\f\rdpsign.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\f\VSSVC.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\r\DiagnosticsHub.StandardCollector.Service.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchProtocolHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\qprocess.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bootconfig_31bf3856ad364e35_10.0.19041.1_none_c2078a8db9a59aef\bootcfg.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\bthudtask.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\DismHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\f\CertEnrollCtrl.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\doskey.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\hh.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.19041.1_none_1894dc7dd8fa15c1\cacls.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\wiaacmgr.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\f\sppsvc.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.1_none_4eca52bc837e6422\BackgroundTransferHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\f\StartMenuExperienceHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\r\svchost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\change.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_fefa067e67e7af8b\r\UserAccountBroker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\r\bash.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.19041.746_none_9043799a93dba365\f\LicenseManagerShellext.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1_none_eb29661c32e6a63a\rdpsign.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\TextInputHost.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.19041.1_none_70fe2109fb29ee11\csc.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.746_none_f4a55c2c3386ed90\f\UserAccountBroker.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_846d8bda2133af3c\whoami.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.19041.1_none_ffa61ab82b82ecca\Fondue.exe- 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_683a0cdb7070602155aa9f1944ec5831_amadey_cobalt-strike_elex_glassworm_hijackloader_rhadama.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 4.9MB
- SHA256 8b88c669d7328345065a796f9528315d133d4a4d80cc5c17b461f53e280224d4
- MD5 2a35a75f1962c6188c1806d6c37204ec
- SHA1 c8356bd495d11b478fcdabe1aa62f0e3454446f3
- SHA512 2de8027db14a64cc4d81a389ca8a29ca925a40f27faa6791e8e90bd81ff59af89a44b37bdc4f5e9c82021237ada620456bf7d7e2dcf78f944b1d584f93df2898
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYq6T3S9tsgX8zEC8ULgCSA/Bkj09Pji0Aja:7fkZcX6zTIOSAHjoW
- TLSH T1B6366D16B3F88637E07A927EC0B15A6DE771342A9B32C6CF3104A66D5D677828536333
- MD5 SHA1 SHA512 SSDEEP TLSH