Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 07:50
Behavioral task
behavioral1
Sample
2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 6.8MB
- Sample260822-jpan2asekc
- SHA256 06308a87df281b4e8a28ed97f86d34b0bc96bed1696fbaa0637f13d8fab0b935
- MD5 b1cee554d4432cad19a286d4d3f75d70
- SHA1 ce843d6886f3f4cd7cd93f6b8fab477426e6d1b0
- SHA512 06ec09b44b7f15a45ec4b66422267c1abe863d1be1227ff61773342784b525be3b240ae2b75b2b120117e3312f936809d0c61a9886a3203be20c6835bc589aa4
- SSDEEP 49152:fkYwCOAIR8ZaeW4SkZP4sz9MbK+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPV+:fFIiZyfkZcb/PvOAjcXvvOOc5n
- TLSH T1FB76170F6E9D4761C86FBD348E55C684E130BC008762A59B2DD07F5DEAB36D9393E222
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\label.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe -
resource yara_rule behavioral2/memory/2808-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c466-5.dat upx behavioral2/memory/2808-646-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2808-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_621effe29fc799ae\SystemPropertiesPerformance.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\CertEnrollCtrl.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.26100.1_none_0142444d3857c993\dplaysvr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_8a3f1279dcc4073c\mshta.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\ScreenClippingHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.26100.1742_none_43ffc3a787af4b46\IESettingSync.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1_none_ea8223e29a7906a5\PackagedCWALauncher.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.712_none_95c89fce0cf184aa\RMActivate_isv.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\r\dpnsvr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellhost_31bf3856ad364e35_10.0.26100.1591_none_e7ad5a201ddffac9\r\ShellHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\r\OOBE\OobeHostApp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\HelpPane.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\r\dxgiadaptercache.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\plasrv.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\SysResetErr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXLauncher.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\XblGameSaveTask.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\replace.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\r\WmsSvc.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\IMEPADSV.EXE- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXHost.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1150_none_96f4f35e249cde0c\wecutil.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\CertEnrollCtrl.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.26100.1455_none_a3b05fa5b61855a2\bridgeunattend.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\r\SystemSettingsRemoveDevice.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\imjpuexc.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\r\AppResolverUX.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\unlodctr.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_f29d806b561540f6\ngen.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_4.0.15912.0_none_d8607d8709732f01\InstallUtil.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseGPParser.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\WPDShextAutoplay.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_bb53ccdac90dda7a\RegAsm.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\r\ftp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WebExperienceHostApp.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_b1cee554d4432cad19a286d4d3f75d70_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.8MB
- SHA256 387208b0407e284ce7013cc3d032a4ddd9e4c40b3934b400bd60bc36b12c2d66
- MD5 ed53b211ad8502d6cd417bc4769f9357
- SHA1 1abd800fa9fb1d02c58f28520d50cc9c66f15609
- SHA512 6d0b8171f31006ed7c2c08cbd874b7f76e80a3552c3b754c76502ae60731071b95f4611505e6d7e392f7dcfe886d4b85944b598094b3972a81a3c6cc8e1bdcf7
- SSDEEP 98304:fFIiZyfkZcb/PvOAjcXvvOOc5UezSC6v2XMHn:NsPbHOAoXvvObc
- TLSH T10D86171A6EAC8362C47FBC748E55C684E5307C008721999B2DC4BF5DEA736D9793E322
- MD5 SHA1 SHA512 SSDEEP TLSH