Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 05:53
Behavioral task
behavioral1
Sample
2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 14.2MB
- Sample260421-glspbsct7w
- SHA256 c976a92a573eab8ed8d99671104abe302069eb3e72d9b5cb8f77ed0b9080d48f
- MD5 1f27544a068b3429f5f50c69ae97dcfb
- SHA1 9f0b5eaeb4f219d68e9ae7c1b58e91c7dd6e9640
- SHA512 a8dac11354335eb2c1d72521971b7a295004bb1188b761c2ecc5d347e3453e35aab1b2f14eae8e088f68b9aaec3b8b793d0fcb72cec868ab6ddbd382c7dacfd3
- SSDEEP 98304:Z3qqUHxqPF4VMNP6T4jo+6d5jow0oAaldmdmnpCjo323SEyRV69DNTIOSAD:ZaHxXMZ6+oto9Kmd0uo3CyP69RTfX
- TLSH T10DE66A03F2638566D0A6C138C8628535D2303F6D87B385EFB958B698FE376D36A39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000002ad6a-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000002ad6a-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/4892-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000002ad6a-5.dat upx behavioral2/memory/4892-538-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4892-3182-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CA565693-D2C5-4BF5-BC9E-F82435F8187A}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\r\wmplayer.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.22000.434_none_ea163a1fcbc61cc7\dsmgmt.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.22000.1_none_6d6f4cb018f2ec3c\csc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_71a457162e76ab00\RunLegacyCPLElevated.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.22000.1_none_636c5fa90121cd59\shutdown.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\r\SearchFilterHost.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\repadmin.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ipconfig_31bf3856ad364e35_10.0.22000.1_none_a27d8ea61cb7b5c1\ipconfig.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\sppsvc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-ldr64_exe_31bf3856ad364e35_10.0.22000.1_none_f3dcf4685272c030\Ldr64.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_fad0aab9b7fd2208\f\RMActivate_ssp_isv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\TCPSVCS.EXE- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\f\SpatialAudioLicenseSrv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\nltest.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.22000.120_none_0e11f85980658aa8\r\ShellAppRuntime.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\PktMon.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_123327ab91644184\raserver.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\qappsrv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.2_31bf3856ad364e35_10.0.22000.1_none_1e1bb3d123f89974\InspectVhdDialog6.2.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_a8719e3ea40f5d74\sxstrace.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\explorer.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\r\winresume.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\r\slui.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\systemreset.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.22000.282_none_a92d755764592be1\f\TokenBrokerCookies.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.318_none_2bc95a47eaa37094\f\hvix64.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\WFS.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15806.0_none_0e9791f66fedf564\aspnet_wp.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_555ad0e288836a51\SearchProtocolHost.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\r\memtest.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\Taskmgr.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\r\wevtutil.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.22000.348_none_e2c7a9ab59285812\r\LockApp.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_5fa2feeecc138dd4\poqexec.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.282_none_aa0f0c4e1a1cb43f\UsoClient.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.22000.469_none_aa2bb1f81a06280c\f\UsoClient.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.22000.65_none_cf76e66c2463ea3d\convertvhd.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-getmac_31bf3856ad364e35_10.0.22000.1_none_6c96deb2db24e7d4\getmac.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.22000.282_none_53574bb7dad4a93c\f\mstsc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.22000.1_none_ec970658acde1577\RuntimeBroker.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\r\bfsvc.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.22000.1_none_d055cf65af7c4d30\UIMgrBroker.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.120_none_7c599f579e2e019d\SpatialAudioLicenseSrv.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.22000.1_none_bfb8876999af625a\cmmon32.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.22000.120_none_9268b7169b04c4a6\r\ClipUp.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.22000.1_none_7aae2e8869defcb3\IEChooser.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\cscript.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_929259dbf5f771f1\iexpress.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\appcmd.exe- 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_1f27544a068b3429f5f50c69ae97dcfb_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 14.7MB
- SHA256 cdeeea76cef4a6e26a049fc0ba949cb414677d08946eeb064b7bc6411de4db38
- MD5 33d896fa5a5b3c8c49580f53ed3f8674
- SHA1 68cb22693e6062aa16e9bfdcb27d57b9b9c13af4
- SHA512 48faa1a03b28978cecaaa3e61e2e77c1a51f13fabe8e6e47f376751b8fd1c8a68709d4781107e85f5371d784e767206a27b491b5df5a1f7ec4147a95025f0ebd
- SSDEEP 98304:Z3qqUHxqPF4VMNP6T4jo+6d5jow0oAaldmdmnpCjo323SEyRV69DNTIOSA7joJ:ZaHxXMZ6+oto9Kmd0uo3CyP69RTfDoJ
- TLSH T18AF67B03F2638566D0A2C138C8628625D7313F6D47B385EFB958B298FE376D36A39711
- MD5 SHA1 SHA512 SSDEEP TLSH