Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/04/2026, 17:23
Behavioral task
behavioral1
Sample
2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 10.9MB
- Sample260426-vx6bfscz2x
- SHA256 0f7ceefa75bce481d84ead55c62d50eca68a444fcc28b8f371fe4dde0c735374
- MD5 d7599ec02e301f58bb0942aa727e27b8
- SHA1 73cacf539a815977e505816dcdfa8f000ad7bad7
- SHA512 f8c883fcad49e350e243e09b2ff126635bbcc28802be55cb4536e1228041f23c2d7cfbe5ad8de1a88e195b03fbc3c0127536cb690282d7259742441f459b1e01
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYd1DV/PvOAjcXvvOOc5fdK:ZaHxXMZ6+oEvd11HOAoXvvO3dK
- TLSH T17FC65B0BF257849AD1A2D134C941C522E2317B69877355DFB96CB39CEE3B6E32A39700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\reg.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\findstr.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\chcp.com- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\label.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral1/memory/4640-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00090000000004e8-5.dat upx behavioral1/memory/4640-537-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4640-3208-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-core_31bf3856ad364e35_10.0.19041.746_none_092d70d1898e5ff9\DismHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\r\autochk.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\r\netiougc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15805.0_none_9d9ad2580504a573\aspnet_compiler.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_70ed7b8b1bf6d9d4\dcomcnfg.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\PasswordOnWakeSettingFlyout.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchProtocolHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1_none_b29cb2f3845833b7\UevTemplateConfigItemGenerator.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSUNATD.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\WSCollect.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1_none_d4cc2ddce5811964\rdpinit.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\f\AppHostRegistrationVerifier.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\licensingdiag.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\lodctr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\f\convertvhd.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\f\BackgroundTransferHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\wscript.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirpcd.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\f\DataStoreCacheDumpTool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\SIHClient.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8ced8f07ec5dee21\iexplore.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVNice.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_610e6b21ab533b13\autochk.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\r\rasdial.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_0f44a2d7a5e3a37a\r\ChtIME.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_1d907c422e447b14\dsdbutil.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\WindowsActionDialog.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.1151_none_15ecde7059d11b7f\f\wslconfig.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\r\SyncHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.1266_none_cfec8db821d83671\winload.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\wpr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\f\wmprph.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\tpmvscmgrsvr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_6d3115c62c48462c\ftp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.1_none_d01fb68c391167d9\rasautou.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg_31bf3856ad364e35_10.0.19041.1_none_5eda5fa3fa7c0fb7\alg.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.19041.1_none_afe6484e54f00fd0\compact.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpksetup.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_3d198a3dbf54d1b4\cmdl32.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\TrustedInstaller.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1_none_805682e34c6552d0\winrm.cmd- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\wmplayer.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\f\ImeBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmimageworker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\f\HvsiSettingsWorker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-agent.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofmt_31bf3856ad364e35_10.0.19041.1266_none_650ebab5a8c02ffc\autofmt.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\r\SearchIndexer.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\ssh-add.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.19041.1_none_65c819c8f144c1f4\msdt.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.19041.1_none_6c03db28ed4132dc\sort.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_8ec2362c55947137\whoami.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_c991318e4b11e4cf\RMActivate_ssp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.746_none_c291aefd01a5d6d6\EoAExperiences.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1_none_8c3cb0a560e64b91\splwow64.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\f\BitLockerWizard.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\pacjsworker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.5MB
- SHA256 2bac3d22e4a7fca5ead1349646fff0b93676bf829fa6eef2e10f9f80811d16d1
- MD5 6cd2b17efb1590089124e756dbbdbc83
- SHA1 bcf6e02eb14aa73531b49ca2f33997ea38060713
- SHA512 7a131c79c5dbafdb8aca544ddc23713294855dacc1ded14d0027d99da4ca3f66d6a9cb99c425739945bd1857d721af2c543ab27b52cbce435878f120555c8d35
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYd1DV/PvOAjcXvvOOc5fd2jor:ZaHxXMZ6+oEvd11HOAoXvvO3dAor
- TLSH T166C65B0BF257859AD1A2C138C941C622E2317B69877345DFB95CB35CEE3B6E32A39710
- MD5 SHA1 SHA512 SSDEEP TLSH