Analysis
- max time kernel
150s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 09:14
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 15.8MB
- Sample261003-k7ftfavfka
- SHA256 5c10b19202d458682cca0fe5548421ce302daa20e8884ebc8f9959c7f77281db
- MD5 7f9ff2503ea3e25e33349016dda3a8ba
- SHA1 2f658a44b64cdb8cff4b36a64b636be63319d911
- SHA512 7c2caf93166550368d4796fdb28ed58a9a26705b5ba872d8e26127b1888db59e0344a33183abe062113c60b0125fc0c6836e30c352c6d7fdb3131141dbba0e27
- SSDEEP 196608:LitTf/cIvP7WyZ/K0ttYVAATjgTH2qBpu1QfLIqsufl:8MNyZ/K0ttYZT8THNBpu1Qfc0l
- TLSH T1F0F64A1272E54AA9D05FD038CE125671A7633C5A8FB19BDF25407EA83E726E07A3431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5e6-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c5e6-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\runonce.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\systray.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\at.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\help.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\reg.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\attrib.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\certutil.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\setup16.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\clip.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cipher.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\net.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\7-Zip\7z.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_57dbe416963fa154\ilasm.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_36d761739f8fd1b7\vbc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\r\MuiUnattend.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_f69d03cd957c2a05\systeminfo.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dasHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.26100.1_none_538243b2b4dbfed1\ipconfig.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\r\fclip.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\r\directxdatabaseupdater.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_bd99d0ef3966360f\winver.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\SpatialAudioLicenseSrv.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\r\OptionalFeatures.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\r\conhost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\r\wbemtest.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_55245726ccbb616f\autofstx.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\Eap3Host.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_6d1bd4f9d0cbd5f8\r\Robocopy.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Windows.PrintDialog_cw5n1h2txyewy\PrintDialog.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\dllhost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\imecfmui.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmdl32.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_87331ff41de2f505\schtasks.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\r\prproc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.26100.1_none_1ae648617b7c1208\NisSrv.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\SpeechModelDownload.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\r\BitLockerDeviceEncryption.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_7f9ff2503ea3e25e33349016dda3a8ba_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.7MB
- SHA256 65342e050a6dad2f0f61b0d22db4dcd7cf459af4a94c1fd25ca52302caeac109
- MD5 4d7d053f0e7c5c47c090c34f38319af7
- SHA1 ab73035933a427b882e83f62f7a984c7d7c03b5e
- SHA512 758dfc977af42d7af547a1b9203c26368d31f507548f335acb308a246db23e3e94a3cd9c5dfea5f8b7adc3f3df308f1046e87cab3e7b257fa6899ab884707473
- SSDEEP 196608:LitTf/cIvP7WyZ/K0ttYVAATjgTH2qBpu1QfLIqsufxb:8MNyZ/K0ttYZT8THNBpu1Qfc0V
- TLSH T1A2074A1271E58BA9D06FD034CE525661AB733C568FB19BDF25407EA83E326E07A3431B
- MD5 SHA1 SHA512 SSDEEP TLSH