Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 01:10
Behavioral task
behavioral1
Sample
2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 16.6MB
- Sample260815-bjcmfacp3y
- SHA256 c63a09da0144f2b612716bbfb9cf7c9de36443878728d9fbc2e211edb7980d85
- MD5 c031a5cddf55c71b9dac21f958e31eac
- SHA1 e17a83607a3821c4f7ff87d4d13046a001c4748d
- SHA512 7ed096d4929e5f1a44b1cedb2f61a12ccb79ea305a6d250be98be36d2be5886faadf5e0c7d233b0f747154ca578b80e835b88367fe452ac006c0f98f95d0a88b
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTf4:ERXMo5zqWYdyZ/K0ttYZTUg
- TLSH T13A075903F293849AE1A9D138C921863197313F6D87F391EF795872D8EA366D33639B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c48a-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c48a-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cipher.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sudo.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mode.com 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/1196-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000f00000001c48a-5.dat upx behavioral2/memory/1196-271-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1196-2918-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3776D576-0A64-4D44-BF96-63E8D160091B}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmLpac.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\audiodg.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\r\dmclient.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1_none_a41d9d6e453f907f\convert.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\SpatialAudioLicenseSrv.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.26100.1742_none_b6069a8cd10e9cfa\r\sppsvc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\charmap.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PATHPING.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasphone.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.26100.1_none_f3687062f0231686\efsui.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\TokenBrokerCookies.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WMIADAP.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\vmconnect.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.0_none_d691427f65d1362f\aspnet_regsql.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\CloudNotifications.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\r\wextract.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\BioIso.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\subst.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\ieUnatt.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\r\msoobe.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_20d2a02f892fa68f\PrintDialog.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\SnapLauncherProtocol.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.27000.360_none_eb22a7e4bb95e7f1\aspnet_regsql.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\msdt.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\diskperf.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.26100.1_none_a0f668eccd5513ba\SMConfigInstaller.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\ftp.exe- 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c031a5cddf55c71b9dac21f958e31eac_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1196
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 17.6MB
- SHA256 5686e8e4cf2ec2c9de387c45c0970d5cb2833a7a510ae172fee23a8428398665
- MD5 def71737117c9b65565ebe84c31ae679
- SHA1 fdd1266f4a9c7be6599bc68decfef042368e1e41
- SHA512 a76595a559f8a794fac4e04054d9272e6fa7b38bfac9ff359c205cc48117a919ffed6365588c0f381089b143fdeac2c95012b0b92d37cab7ad60b126815f1c93
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTf+y:ERXMo5zqWYdyZ/K0ttYZTUR
- TLSH T149075903F297849AE0A6D138C961863197313F6E87B385EF750872D8EA376D37639B11
- MD5 SHA1 SHA512 SSDEEP TLSH