Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/10/2026, 15:00
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
- Size 13.0MB
- Sample261003-sdl3cs1dld
- SHA256 3e3ee3022e2df12ef312e1fbc868ebc326f90a00a11df56ff862587965f60df2
- MD5 319e0e984a0fa4368ac7461a487375b4
- SHA1 54afbf437f27ac7dd53d5d4ca107cf827379132f
- SHA512 d54dc57c1a196b3ffae0a3496418f03f5a53a0e4194a4a649ba3e786aa77cd1e67feebd5359acc2e99e0a6a60892fc7006a3cd15b691daae39ca38dde8f5de88
- SSDEEP 98304:kqiR3TIOSAzLapIXfkZcGLapIwKUgTH2M2m9UMpu1QfLczqssnKSz:LitTf/cIvPGcIggTH2qBpu1QfLIqsufz
- TLSH T11CD6282231E58F99C05F9034CF16666597A33C5A8FF19BDB24407EA93E726E07A3520F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral2/files/0x000d000000016d03-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x002400000001c57c-1110.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/files/0x000d000000016d03-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x002400000001c57c-1110.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chcp.com- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\logman.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tree.com- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\wscript.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\choice.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmd.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\psr.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\recover.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\sudo.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\subst.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\compact.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\cttune.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\replace.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\hh.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_139e8f2156be3ffe\regini.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\r\gpresult.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\PktMon.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\UserAccountBroker.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2f8b84e3f73f010f\tasklist.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_ada7adeacc9ba8d6\aspnet_regbrowsers.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\sxstrace.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\r\fixmapi.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\msil_servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_ef0c64fcaf8f69dc\ServiceModelReg.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\r\colorcpl.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\HelpPane.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.26100.1_none_2350f58e1a989738\etfsboot.com- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\BrowserCore\BrowserCore.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\TCPSVCS.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15912.0_none_f28dd746997c1837\CasPol.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5542cd086dc867d0\cacls.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-resume_31bf3856ad364e35_10.0.26100.1742_none_091721c8d0a92082\winresume.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_460eda816899b508\dsacls.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\dmclient.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.26100.1591_none_b94392693d48770c\r\LegacyNetUXHost.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\r\PATHPING.EXE- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_userexperience-oobe_31bf3856ad364e35_10.0.26100.1591_none_54983d2d7a4908c4\r\OOBE\OobeHostApp.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_windows-defender-offline-amcore_31bf3856ad364e35_10.0.26100.1150_none_e08d5281f8c7a395\OfflineScannerShell.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\wsmprovhost.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\r\BioIso.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_c319a5f63c95aa27\vbc.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.26100.1150_none_a3d1faf3bbc1c7d8\rekeywiz.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\msfeedssync.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_a2039c43d1b59b62\setupugc.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\cscript.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-corruptedfilerecovery_31bf3856ad364e35_10.0.26100.1_none_84ad60409153e8ea\cofire.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.26100.1_none_012c60dec828ce67\ssText3d.scr- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_319e0e984a0fa4368ac7461a487375b4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_i.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.0MB
- SHA256 05651050882fdcb1b150cbea00310888aaf0b22b861471ac0f602d4610b26cdb
- MD5 cef64a1f899d83a9ef04a34f73e76123
- SHA1 f23276d6ba86eb72327012b9988499fdf92d4939
- SHA512 c83fcfb7cd276b8e130d86e0c63b0d50ca87c01f5c270b2feead8dfc305d07580798768b24d77eb57f941bf57d309ec94dd1e7bc47ca4b8caa1533f7e6c46fc2
- SSDEEP 196608:LitTf/cIvPGcIggTH2qBpu1QfLIqsuf/F:8M0kTHNBpu1Qfc0d
- TLSH T193E63A2271E58F99C05F9034CF426665A7633C5A8FF18BDB25407EA93E326E07A3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\GroupDisconnect.bat-
- Size 13.7MB
- SHA256 d009ded7167aac768f5654f16a48fbc4806d45976c05e4199e11330094af9316
- MD5 ff38a34c3560a3fa104450cff206ec2e
- SHA1 c4965dfad654898dcab0c03e21c88bae8f2fd803
- SHA512 d55ff38b766a07e004b48ba2bd252170415f4d8138d5b082fcb7b64f2b3510e73775c4fdd76665d7da67e9bae30e70af08355eacbf1de15a6ad7d71ae36e7d94
- SSDEEP 196608:LitTf/cIvPGcIggTH2qBpu1QfLIqsufd20rz7:8M0kTHNBpu1Qfc086z7
- TLSH T13CE6392231E58F99C05F9034CF16666597A33C5A8FF19BDB24407EA93E726E07A3520F
- MD5 SHA1 SHA512 SSDEEP TLSH