Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 04:31
Behavioral task
behavioral1
Sample
2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 14.1MB
- Sample260816-e5w5razcpc
- SHA256 c215b281e3901d038e624dc68aec5d4b9981826dbb97f7dd43eaddf1912556d3
- MD5 58f50aaae7ab198dbdfc86d9570c345b
- SHA1 46153fc41a52edb0c55d8537d2998280f188492f
- SHA512 94a136b61c48fae69ab6c350d206671917721fb943c72546c7952dc6566ef36af7900d543984a956d7c2b1eb5045117cd046c80dffb7d935506da221a1ad8134
- SSDEEP 196608:KiGQnMkhgJuP32+dmhZk/9PCgTH2qBpu1QfLIqsufe:F5nHS+2MTHNBpu1Qfc0e
- TLSH T102E66B1966D64FA9C45F9074CE4B6560A623BC024F209FDB3A8CBF283F716E15A3425F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral2/memory/2132-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000f00000001c4e4-5.dat upx behavioral2/memory/2132-290-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2132-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\FileDialogBroker.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_a9d07790da9b357f\grpconv.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpshare.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\ttdinject.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\DeviceCredentialDeployment.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.26100.1742_none_227796ba348ec62b\r\MoUsoCoreWorker.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\r\EhStorAuthn.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1150_none_723b9016a5d6336f\printui.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsv.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\TCPSVCS.EXE- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_9c81814c454e23f1\vbc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.26100.1150_none_44d0a2970b0871bf\alg.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\r\PhotoScreensaver.scr- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\r\scrnsave.scr- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1150_none_3c9a0c46a6db0711\WinMgmt.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.26100.1591_none_0904540289bfb971\agentactivationruntimestarter.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\r\ctfmon.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\r\UsoClient.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\hnsdiag.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\SnapLauncherProtocol.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\OOBE\OobeHostApp.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_aa82bd90bcd50b03\AppLaunch.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\WindowsBackupClient.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\ftp.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1695d375c2f4d597\ServiceModelReg.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\r\WorkFolders.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\r\psr.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sudo_31bf3856ad364e35_10.0.26100.1_none_a2b1ee1b85e5539a\sudo.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\upnpcont.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\Utilman.exe- 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_58f50aaae7ab198dbdfc86d9570c345b_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2132
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.0MB
- SHA256 c2487e43a5e5074d3fd83683c0b8773aaca6a2e4c53937efd4f3fe8c1716fe3b
- MD5 667155b83234dd4f8ba623d5265e0c66
- SHA1 38b3eadefd2aa125d72664c41e9c30b12f963357
- SHA512 afd00ca3473c2fb6a05d20eac68cda37b88393d34ea7314d1cedb02656ac30dffe1cc96487f5168a51832fec7163917870717db07e20742c7518e7869b85949f
- SSDEEP 196608:KiGQnMkhgJuP32+dmhZk/9PCgTH2qBpu1QfLIqsufsV:F5nHS+2MTHNBpu1Qfc0k
- TLSH T110F66C1966E54BA9C45F9074CE4B6561A6337C024F209FDB3A8CBF283F726E15A3421F
- MD5 SHA1 SHA512 SSDEEP TLSH