Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/04/2026, 18:56
Behavioral task
behavioral1
Sample
2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 17.7MB
- Sample260427-xls8vsf161
- SHA256 726ec1eaf6e36922f0ef3850773055081dae36c773650dc7637db7a0f8dd90f2
- MD5 e128da7b38f589470dd730ee3049e82d
- SHA1 3cf71241f4b2184110f72aac282e44ebcdace036
- SHA512 eab719aaff90a94ceba37a1a58e253f28833b7043d0110240417162a61d0b87845f297fe698b131b125fb07c8c07391032d67b1edf733972722a80085d792929
- SSDEEP 98304:cIHCDFbtLK3BDhtvS0Hpe4zbpaAKQkroGI0w2TIOSA7/PvOAjcXvvOOc5+joK:cIPBnvjeApaAvkt1TfXHOAoXvvOQoK
- TLSH T158175B4A7E98849EDCBC5E3449198932FA307C4F7E29A64BFD40771E7A332D26915332
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x002100000002b19d-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x002100000002b19d-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dialer.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral2/memory/3928-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x002100000002b19d-5.dat upx behavioral2/memory/3928-386-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3928-3186-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\f\nvspinfo.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.22000.1_none_2f02b4dfdc90d704\PerceptionSimulationService.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.22000.1_none_6de3b97f02b362b7\aspnet_compiler.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.22000.1_none_4b3b75ad087c3772\eventvwr.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.22000.1_none_394d6561ecf74d41\mqbkup.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.318_none_15d95e5ea6111bc3\r\sppsvc.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-oneoffs-em_31bf3856ad364e35_10.0.22000.318_none_ed2b4c25cc173a5f\n\EM.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.22000.348_none_1cb0f82bf1aef3cc\f\lpremove.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\r\RMActivate_ssp_isv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.22000.1_none_cdf956c212ab6c00\DsmUserTask.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_eeb0f55fae54e327\wextract.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.22000.1_none_bfc4aabf015b7a53\SyncHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_25381cfb8a14a984\wiaacmgr.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\f\RMActivate_isv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\f\TpmTool.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.22000.434_none_b0e36fb9b88e8b56\r\certutil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.376_none_742ed331adb702b6\WFS.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_eb1a21d23daf2030\r\NcsiUwpApp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_6882f2754501b4c0\rekeywiz.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.22000.1_none_542efeeac7d0b582\CertEnrollCtrl.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15806.0_none_fcd274061b4264d8\AddInUtil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\hvix64.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.22000.41_none_506d5972b4817c83\f\Magnify.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_c1bbc2c937fef3c3\relog.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.22000.1_none_71c134a2fff387d0\WPDShextAutoplay.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.22000.1_none_e8a0f20bd3d53965\CameraBarcodeScannerPreview.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.22000.1_none_a875ef267740234b\net.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\notepad.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.22000.434_none_fc228ebcd84d69db\repadmin.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\msinfo32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_ad3d2613cd22d055\f\wevtutil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\f\BdeUISrv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\n\MiniSearchHost.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\f\SpatialAudioLicenseSrv.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.22000.1_none_f49ae11ddec89744\changepk.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.469_none_560fc7f19d1d3ed7\f\VSSVC.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.22000.1_none_0e0860b6be3fb3ea\wmpnscfg.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\r\SIHClient.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.22000.100_none_cbf7ec6fc0f80985\f\SndVol.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_c58bc93032642398\f\winrm.cmd- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros..x-deployment-server_31bf3856ad364e35_10.0.22000.493_none_e73dfe4d18ff7931\f\CustomInstallExec.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.22000.1_none_cf3d4a0d2d2f7851\FXSCOVER.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.22000.1_none_baa7a7b212bbc28d\tttracer.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.22000.1_none_f1914deb6513ab32\coredpussvr.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.22000.1_none_87bb487f5d189323\TSWbPrxy.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\fsutil.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.22000.1_none_389d9987e414684f\rundll32.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\f\vfpctrl.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.22000.348_none_8c1cd5f65f938380\f\DataStoreCacheDumpTool.exe- 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-27_e128da7b38f589470dd730ee3049e82d_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.2MB
- SHA256 3df05f93990e44bfa20e49710384bbb3b82b9a0fd7b3a6a5ce9629701a9da8f7
- MD5 31c9050a2f2d9c86ff3acaa565cd40b4
- SHA1 590e332d0c053c768c3e78341779cd7c4d14e84c
- SHA512 1c438efea0f1ff411f05d0c0b739e1e10c6639475899d3a0f505720e78975190a57f6aee3f8d212fc027869259ddb8d8678b3d8ca60d86e348602cbce7854a27
- SSDEEP 98304:cIHCDFbtLK3BDhtvS0Hpe4zbpaAKQkroGI0w2TIOSA7/PvOAjcXvvOOc5+jo2joW:cIPBnvjeApaAvkt1TfXHOAoXvvOQoAoW
- TLSH T15A176C467E98859ECCBC8A3449598936FA307C0F7F29A64BFD40771E7A332D26915332
- MD5 SHA1 SHA512 SSDEEP TLSH