Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/09/2026, 22:41
Behavioral task
behavioral1
Sample
2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
- Size 21.0MB
- Sample260909-2l3jrabl21
- SHA256 e67d57aca70d223d36811b63f48c3b74862b597642d520a20f9e5a6efc25ce7c
- MD5 2a3511f0917a3bf64e11332272f7a35a
- SHA1 1150cd973f57ca7a735a6e9930c88fa931717ebd
- SHA512 ddc203775760941165b98dce981a40940334053e129ca2bc685b4da6fd9c4d4ffb98c36d0ecd167b1ecdeb754f0eb0bff6f23675102432186d7b157d9b331af8
- SSDEEP 196608:/vU3BnvjeApaAvktoNwnYBzzXygTH2qBpu1QfLIqsufKHOAoXvvOK:mNvjtIAvkGNwszLhTHNBpu1Qfc0gOTD
- TLSH T127277C0663E98AF9C0AF9134CD569661E6327C854F30ABDF55807F1A3F366A05E3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\wusa.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\curl.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sc.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\replace.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\tar.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\help.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sethc.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\comp.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\format.com- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe -
resource yara_rule behavioral1/memory/2324-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x0008000000024649-5.dat upx behavioral1/memory/2324-352-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2324-3212-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zFM.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.19041.1_none_8d387dde0a6c6d14\VMCreate.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\r\WSReset.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_ee5c058bea34543e\r\WmiPrvSE.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\f\autoconv.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\r\iisrstas.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_e112f07513949221\edpnotify.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2b8b5a41940eac9f\r\prevhost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\wab.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\f\msconfig.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1_none_8c3cb0a560e64b91\splwow64.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.19041.1_none_39961f6f77f90ff5\UserAccountControlSettings.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_1ea3d2b20faf7de3\f\fontdrvhost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.84_none_42927ae06bc1dce9\r\WpcMon.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.1052_none_0bde546bcaf8e34a\ClipUp.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_63078cde447629b6\cipher.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\aspnetca.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\logman.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\r\mighost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\r\sessionmsg.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_76eb13d6387f99ed\csc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.19041.1_none_729f314325319478\mountvol.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.746_none_5536c5683efe1dad\r\CameraSettingsUIHost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.1_none_6bac6724a4ab4460\svchost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.19041.1_none_7a6e62f3d1012ed4\vssadmin.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.19041.1_none_a4a8dfd6e5f1aab8\dsmgmt.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.1_none_15ad78a57833209d\CompPkgSrv.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\TSTheme.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.19041.1_none_3b7fdf76aa8cfd53\WindowsUpdateElevatedInstaller.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\PING.EXE- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\vfpctrl.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.19041.1_none_061d84508b376f80\WmsDashboard.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.1_none_59b1b1137e3c1ce3\control.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_95938c4a44e792de\ReAgentc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\r\wowreg32.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setx_31bf3856ad364e35_10.0.19041.1_none_6267e352b86de969\setx.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_425d54d86cc1f3e2\r\tttracer.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.264_none_31474dbf12ce5adc\f\XblGameSaveTask.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.207_none_c5e1b9def3522696\r\securekernel.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_c780234a16dfd399\TabTip.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1_none_da86158885d71eb7\wscadminui.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\r\NgcIso.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1_none_468ab6f0be9f26c6\msinfo32.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\r\winresume.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\wecutil.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\f\OOBENetworkCaptivePortal.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..s-datausagehandlers_31bf3856ad364e35_10.0.19041.746_none_dbecc8a3cdc7c3cf\r\DataUsageLiveTileTask.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\usocoreworker.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\r\StartMenuExperienceHost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.1_none_8b3ee1f81086d0e3\ReAgentc.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchProtocolHost.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\WinRTNetMUAHostServer.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.19041.1_none_f1d9ebd2fe6dc15b\reg.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\f\CredentialEnrollmentManager.exe- 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-09_2a3511f0917a3bf64e11332272f7a35a_akira_amadey_cobalt-strike_darkgate_elex_glassworm_hijac.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 21.6MB
- SHA256 0ab6aec91f74463370229f0dc1d9f377f4ba8466c5f393ee5c5d9aa50e729d9c
- MD5 a9a6a9fa8ded27e031718b7e178ed916
- SHA1 ef223876749256fda2a77fd9b422fde25ee0bff9
- SHA512 fb547c3c2d1a8865f4c368f99504b6a89248619e99fd805f7e4dad21865227e0345e2a5ffd1212178cb23aa929e0a924eadf21907e92aa4b00ec99b52433b9b6
- SSDEEP 196608:/vU3BnvjeApaAvktoNwnYBzzXygTH2qBpu1QfLIqsufKHOAoXvvOAon:mNvjtIAvkGNwszLhTHNBpu1Qfc0gOTQn
- TLSH T1F4377C0666E98AF9C0AF8134CD569661E6327C854F30ABDF55807F1A3F366E05E3831B
- MD5 SHA1 SHA512 SSDEEP TLSH