Analysis
- max time kernel
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 23:51
Behavioral task
behavioral1
Sample
2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 25.2MB
- Sample260812-3v9vvsfd55
- SHA256 c929d6fe61c2c7b2b063f0511838eb8fe2fcd2bab457e0fb9e3d524d4069506a
- MD5 ebed587b8d8ee8d519a279b17268e890
- SHA1 9c7d2f23434d1801caa0598ad45b713da8335804
- SHA512 b60e700c98ea548b6aa50f54850767cdaa0aa65a1e883a9f2f8e72ec47f02ae42964321336dec5fac03c0b421d5b04e84ece7a8e72003d733eb96f98d97b4a09
- SSDEEP 786432:ERXMo5UkIY092b9HNBpu1Qfc0MHNBpu1Qfc0h:ERXMo5UkDYFYA
- TLSH T1A6474912A2978F9DC05F9434CD0665A156233F5A8F735BEF68447D28FA362A36E3420F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5a1-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5a1-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\find.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1960-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c5a1-5.dat upx behavioral2/memory/1960-214-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\r\upnpcont.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\winhlp32.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\vmwp.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\r\AgentService.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\SpatialAudioLicenseSrv.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_d4511ac951bbf539\r\powershell_ise.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\aspnetca.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\FileDialogBroker.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\r\Narrator.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\r\WpcUapApp.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-notify_31bf3856ad364e35_10.0.26100.1_none_19e613be108c5c51\fvenotify.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\setupugc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\ctfmon.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.SyncController.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\r\CapturePicker.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\r\colorcpl.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\r\proquota.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\msra.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\NgcIso.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\winhlp32.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\r\setupugc.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.26100.1_none_dc91fd1f1af84c4d\MSchedExe.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_ffc7c01130849273\shutdown.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\ResetEngine.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\containerworker.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_ebed587b8d8ee8d519a279b17268e890_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 26.2MB
- SHA256 6e9659ba6f342e69876b9ddc0124455ace0c8c9d3165ee322f9c0ff6f31a2e72
- MD5 ce5f0b4374042ca3475759ef56bc2b92
- SHA1 dea76bdfe49612cd43a45faf61e3291b574196c7
- SHA512 36ced4e51c80922a88dc884b4a63867f595a82b54849c7af974183d1a7121aa2347c524b32f56087d39c049a80535193cc585855c02dc317fbc06003504247dd
- SSDEEP 786432:ERXMo5UkIY092b9HNBpu1Qfc0MHNBpu1Qfc0J:ERXMo5UkDYFYo
- TLSH T1E4575A12A2978F99C05FD434CD0665A156233F5A8F739BDF68447D28FA362A36E3420F
- MD5 SHA1 SHA512 SSDEEP TLSH