Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
- Size 14.5MB
- Sample260808-ts1pqszgrg
- SHA256 1ffe4f8a12d14b2f166b140c93650158700476b3d86150687553511144b663da
- MD5 35f3a461a7c966f58f216505b96b4f0f
- SHA1 690d81eba1d00f7df63ca89f3781ffa5339c8762
- SHA512 3f0b7cef8365fa3593141021780072abffaffc1d603a4ef30132c66a1147028193b5817c9627a22d133728822c0ae2ca77f5e32aba44f5ff8622bda55e6968a4
- SSDEEP 196608:Su5oKHOAoXvvOlojosKmd05eGZF6bUpMBF1p/kjRm4OWi2b0:6gOTBM7quIbUwF1VERmj2b0
- TLSH T1FAE6CF1EB26845A5D066C078CE82C616E731BC4587B196DF2290A7ED2F777E27F3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftp.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\tree.com 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\format.com 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bubbles_31bf3856ad364e35_10.0.26100.1_none_6b71ee9c327e3c02\Bubbles.scr- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\omadmprc.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\finger.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\WPDShextAutoplay.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmcfghost_31bf3856ad364e35_10.0.26100.1_none_2122cf9edbab3972\dmcfghost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.712_none_685cc408c767126a\Windows.Media.BackgroundPlayback.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\vmplatformca.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\msra.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXHost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\r\AtBroker.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.26100.1_none_1346e96d3ee86ee9\getmac.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\typeperf.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\winhlp32.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgrsvr.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.26100.1150_none_8b65f13ba864c9e1\sysprep.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_e07e7d7d170e8df4\vbc.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\r\dllhst3g.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.26100.1_none_ea4a5d2678ee83a1\Netplwiz.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\LaunchWinApp.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\r\ftp.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1_none_ebab7ab3af20bec2\dsmgmt.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\audiodg.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\r\RelPost.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.26100.1_none_8917e9dc16872bc9\easinvoker.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\r\upnpcont.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1150_none_3c9a0c46a6db0711\WinMgmt.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\SnapLauncherProtocol.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_10a40aea1dac80e8\powercfg.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\dxdiag.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\r\dxdiag.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpresult.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.26100.1150_none_15f982365a9d2243\UIMgrBroker.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_51450313e3636a10\r\certutil.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPUEX.EXE- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\ntkrla57.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.26100.1591_none_538f0058df8c2519\provtool.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\r\rrinstaller.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..services-core-files_31bf3856ad364e35_10.0.26100.1150_none_2bd28325d6e61084\dsamain.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\fc.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\OpenWith.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe- 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_35f3a461a7c966f58f216505b96b4f0f_akira_amadey_cobalt-strike_elex_eternalromance_glassworm.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.5MB
- SHA256 373ed4e093f25594176d986ad3df73a23133c33f552a5c1ed299aff1f568b8e6
- MD5 e3ce2627c5552dc2becfa137b3156973
- SHA1 0bab4a7b37d2cc6f5dd4bb6749901a25d7f7db0e
- SHA512 74e594d98dfaa28fa471deb21203c09210698a79f9154766674e80df057d46c8704f6d2a2b00d06847022ab2d6d5c4dc53924972481daaa5d5f3a6370e938b82
- SSDEEP 196608:Su5oKHOAoXvvOlojosKmd05eGZF6bUpMBF1p/kjRm4OWi2bqV:6gOTBM7quIbUwF1VERmj2bS
- TLSH T129F6CF1EB26842A5D066C079CE82D616F7317C4547B196DF2280A7ED2F777E27E3A320
- MD5 SHA1 SHA512 SSDEEP TLSH