Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/04/2026, 18:56
Behavioral task
behavioral1
Sample
2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 17.7MB
- Sample260427-xls8vsf161
- SHA256 726ec1eaf6e36922f0ef3850773055081dae36c773650dc7637db7a0f8dd90f2
- MD5 e128da7b38f589470dd730ee3049e82d
- SHA1 3cf71241f4b2184110f72aac282e44ebcdace036
- SHA512 eab719aaff90a94ceba37a1a58e253f28833b7043d0110240417162a61d0b87845f297fe698b131b125fb07c8c07391032d67b1edf733972722a80085d792929
- SSDEEP 98304:cIHCDFbtLK3BDhtvS0Hpe4zbpaAKQkroGI0w2TIOSA7/PvOAjcXvvOOc5+joK:cIPBnvjeApaAvkt1TfXHOAoXvvOQoK
- TLSH T158175B4A7E98849EDCBC5E3449198932FA307C4F7E29A64BFD40771E7A332D26915332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000600000001e423-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000600000001e423-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral1/memory/3028-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000600000001e423-5.dat upx behavioral1/memory/3028-324-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/3028-3200-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_d016f232fbeefbad\sdiagnhost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.264_none_e85c49c0793f9f24\f\Win32WebViewHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\r\pacjsworker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\r\PasswordOnWakeSettingFlyout.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.19041.153_none_3c9b504ec5293ad0\WpcTok.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\r\SystemSettingsRemoveDevice.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.746_none_c2332356a565df1c\dialer.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchIndexer.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_b4746d3aaf96ef0d\regedt32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1_none_d6008c7292c63a76\runonce.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.19041.1_none_d6f1c935a875f141\UserAccountBroker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.928_none_1d29b4735b607954\services.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\f\prevhost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.746_none_fa033ad7aa9be481\SpeechUXWiz.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.19041.746_none_18c3ddf7dbfedda0\r\PinEnrollmentBroker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\nltest.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.19041.1202_none_e867a49a6e97813d\f\LaunchWinApp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\f\PasswordOnWakeSettingFlyout.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.19041.1_none_67326312c2487423\EduPrintProv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.789_none_e07abbe9902a4f60\f\Utilman.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.264_none_7517ff6e147bc8a9\r\pacjsworker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_fb1129caa00e000f\f\msinfo32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.19041.746_none_9ebd3ef9f0c794b5\WmsSvc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\r\smss.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_4d67350a685e1a3a\bthudtask.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_63078cde447629b6\cipher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\r\dfrgui.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.1_none_7e470436241a018f\hh.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.19041.746_none_1da55dc225237a0d\r\InputPersonalization.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-keygen.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_b6126993bc8370e6\SMConfigInstaller.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\r\aitstatic.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8591bd54bdb2be6f\AtBroker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_02f2b1ed23420c30\at.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.746_none_43128ab833fd583f\fsquirt.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingShell.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_77b40a18a99e4f02\csc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1_none_faedbaa2bd7d01c2\MDMAgent.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.19041.1_none_4a1699e73b1ad297\SlideToShutDown.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.19041.1081_none_491d51c316b5ea8f\wsqmcons.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\SysResetErr.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.19041.1_none_3a8d8b0c2eae5eda\DpiScaling.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\eshell.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\f\WMPDMC.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.19041.1_none_4547ebb03c53c11a\DataSvcUtil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.19041.1_none_827105fe900187d1\wiawow64.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\isoburn.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVNice.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\r\bash.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXLauncher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\scp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\f\cleanmgr.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsp_31bf3856ad364e35_10.0.19041.1_none_39d506065bd87607\vmsp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\r\ClipUp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.19041.1_none_7e963f23aba941dd\MicrosoftEdgeSH.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.19041.1_none_da6b9c85304fbda8\sdiagnhost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_7e723dd43021c2d3\ImagingDevices.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.2MB
- SHA256 3df05f93990e44bfa20e49710384bbb3b82b9a0fd7b3a6a5ce9629701a9da8f7
- MD5 31c9050a2f2d9c86ff3acaa565cd40b4
- SHA1 590e332d0c053c768c3e78341779cd7c4d14e84c
- SHA512 1c438efea0f1ff411f05d0c0b739e1e10c6639475899d3a0f505720e78975190a57f6aee3f8d212fc027869259ddb8d8678b3d8ca60d86e348602cbce7854a27
- SSDEEP 98304:cIHCDFbtLK3BDhtvS0Hpe4zbpaAKQkroGI0w2TIOSA7/PvOAjcXvvOOc5+jo2joW:cIPBnvjeApaAvkt1TfXHOAoXvvOQoAoW
- TLSH T15A176C467E98859ECCBC8A3449598936FA307C0F7F29A64BFD40771E7A332D26915332
- MD5 SHA1 SHA512 SSDEEP TLSH