Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
26/04/2026, 17:23
Behavioral task
behavioral1
Sample
2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 10.9MB
- Sample260426-vx6bfscz2x
- SHA256 0f7ceefa75bce481d84ead55c62d50eca68a444fcc28b8f371fe4dde0c735374
- MD5 d7599ec02e301f58bb0942aa727e27b8
- SHA1 73cacf539a815977e505816dcdfa8f000ad7bad7
- SHA512 f8c883fcad49e350e243e09b2ff126635bbcc28802be55cb4536e1228041f23c2d7cfbe5ad8de1a88e195b03fbc3c0127536cb690282d7259742441f459b1e01
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYd1DV/PvOAjcXvvOOc5fdK:ZaHxXMZ6+oEvd11HOAoXvvO3dK
- TLSH T17FC65B0BF257849AD1A2D134C941C522E2317B69877355DFB96CB39CEE3B6E32A39700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmd.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\expand.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral2/memory/3400-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0016000000025a2d-5.dat upx behavioral2/memory/3400-658-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3400-3182-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.22000.348_none_e639e7a3fcfcf06b\r\securekernella57.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.22000.1_none_408e00a93eb2182b\DeviceProperties.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.22000.1_none_c387f681de81f59d\agentactivationruntimestarter.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\wmplayer.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.22000.1_none_12f1c1658a9d216d\mountvol.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.22000.194_none_ecba39f8d9cbe846\r\bdechangepin.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVStreamingUX.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.22000.1_none_ae9fb5eb30be85c5\WFServicesReg.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVStreamingUX.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\bfsvc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.22000.348_none_a83a13d7c7ca92d4\nfsclnt.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_b7c933829422be28\netiougc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.22000.1_none_d639883a6cfed852\aspnet_state.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.22000.100_none_a1709384527830fe\f\SecurityHealthService.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.22000.1_none_dae01b2e9419ebcf\DpiScaling.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_c92bb840373729ed\AddSuggestedFoldersToLibraryDialog.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.22000.1_none_95defc35c15b2b6b\bash.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\r\Microsoft.AAD.BrokerPlugin.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\r\LsaIso.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.22000.1_none_5640d9ef21678ad0\ssh-keyscan.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseIR.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.22000.1_none_3038f7c9577f0d5f\AtBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.22000.1_none_52f20556dd84fc53\charmap.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.22000.120_none_9ed34dd5b0c53507\f\WpcUapApp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpinit.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.22000.37_none_b6eb9704869b2bfc\f\InputSwitchToastHandler.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.22000.1_none_8f75957b26bc3516\inetinfo.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\aspnetca.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.22000.1_none_0af1ba5c97d13826\nfsadmin.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.22000.1_none_63c1e7db07fabcb1\msoobe.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_123327ab91644184\r\raserver.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.376_none_f2dd928d310396ab\f\vmcompute.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\wsmprovhost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.318_none_de01ffa2be1c4596\memtest.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.22000.434_none_6dc3a5a2d0fafee9\r\certreq.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\r\wevtutil.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_6341f7e76a67243d\Utilman.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.22000.1_none_1c7f192e4c9e218b\verclsid.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.22000.1_none_a631d85ed7b16283\aspnet_regbrowsers.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.22000.120_none_05dfd9bc9f8bc6b6\f\Win32WebViewHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\r\ApplySettingsTemplateCatalog.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.22000.1_none_1b78a2bc0a780f77\DFDWiz.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.22000.1_none_ba24b227075f89a4\hvsiproxyapp.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\r\SysResetErr.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\r\explorer.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\TextInputHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros..x-deployment-server_31bf3856ad364e35_10.0.22000.493_none_e73dfe4d18ff7931\f\ApplyTrustOffline.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.22000.1_none_e001e2e2fc49e1bc\ImeBroker.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\r\printui.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\f\winlogon.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.22000.1_none_141cd469f7aeedb6\cttune.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_dbc66c84afafb5a2\f\printui.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.22000.348_none_67702744b34d2d9d\f\HelpPane.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\iisreset.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.22000.1_none_b5e493e3fca1e5c2\netsh.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.434_none_e6157b76b496d682\f\refsutil.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\r\nltest.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\r\UtcDecoderHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\MiniSearchHost.exe- 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_d7599ec02e301f58bb0942aa727e27b8_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.5MB
- SHA256 2bac3d22e4a7fca5ead1349646fff0b93676bf829fa6eef2e10f9f80811d16d1
- MD5 6cd2b17efb1590089124e756dbbdbc83
- SHA1 bcf6e02eb14aa73531b49ca2f33997ea38060713
- SHA512 7a131c79c5dbafdb8aca544ddc23713294855dacc1ded14d0027d99da4ca3f66d6a9cb99c425739945bd1857d721af2c543ab27b52cbce435878f120555c8d35
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYd1DV/PvOAjcXvvOOc5fd2jor:ZaHxXMZ6+oEvd11HOAoXvvO3dAor
- TLSH T166C65B0BF257859AD1A2C138C941C622E2317B69877345DFB95CB35CEE3B6E32A39710
- MD5 SHA1 SHA512 SSDEEP TLSH