Analysis
- max time kernel
150s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe
- Size 3.7MB
- Sample260710-wct85agv2w
- SHA256 4d733d5e663f6c929166907fd12f7fa6045758580348ad302182d836c935a3db
- MD5 76152ccf7554d1359e6c108f53249c36
- SHA1 f67b7f560c39cfdca7f7d2855f3621d346df297b
- SHA512 ccfcd8bbe0885fb1aa3afc692c04b14b7fc286943e77911cc2837381e2248eeec3b6a9ec3f4ef3752f02dd04ec5b3b359d525895b5b0ea1ad6dce7de74568048
- SSDEEP 49152:kpr+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN75Q:kg/PvOAjcXvvOOc5Q
- TLSH T105064A1E735884E9D5A6D1BD8A868506F371F801CB3156CF26A4875E2FBB7E34E3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\cttune.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\winrs.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\wscript.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\fc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\help.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\sc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\label.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\wextract.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\choice.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\logagent.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\compact.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\dllhost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.26100.1742_none_07d5a4b5643ebc7c\r\ntoskrnl.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\relog.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\plasrv.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\HelpPane.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\mighost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\r\rstrui.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-upprinterinstaller_31bf3856ad364e35_10.0.26100.1150_none_4ef2fca3d76b94b2\r\UPPrinterInstaller.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\BioIso.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.26100.1_none_ed0315824c80c112\fveprompt.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\sftp.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.26100.1_none_6b60acbaf3301f6c\_isdel.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\lodctr.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\UsoClient.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\r\prevhost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\licensingdiag.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1_none_e42fc57779c55fcd\cmdkey.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1_none_713b7d7638176261\TapiUnattend.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\r\dcdiag.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\wifitask.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_068e99c8dd0d8394\aspnet_wp.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-repadmin_31bf3856ad364e35_10.0.26100.1150_none_9cab7767030559d4\repadmin.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\iexpress.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\r\PerceptionSimulationService.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\WSReset.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_752bfd0c9236819e\mscorsvw.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_48b7f6550888b909\r\ftp.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmscrub.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\WDAGNetDiag.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_597aa4330f646c5b\net.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchProtocolHost.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\ieinstal.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\LicensingUI.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchIndexer.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1_none_5459e3b4a959687e\bitsadmin.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_76152ccf7554d1359e6c108f53249c36_akira_cobalt-strike_elex_glassworm_hijackloader_icedid_n.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.6MB
- SHA256 35f417606d54e703d839d73bb1fe8504efbb85813fcbe2aa56ce28b15afd81fe
- MD5 4b545dd47f8666689ab36866b5cb4318
- SHA1 df154b399c2fd6e6b39fa383f745d8b33ebe6bb1
- SHA512 d41de70f7e0d58c74c54693608f2d5b9e54dd833cefd88d38443577a1c947e9485b40f73a5acad113aba0ac5d6cc596ba6d449e5d2cd8018d3589edef6091ba5
- SSDEEP 49152:kpr+/PivcpfQvdaKYXf3CUeyjc4t2vLemGa2pcPVx7EhI2AM7/0XOMJU1QqpN75/:kg/PvOAjcXvvOOc5BezSC6v2XMHz
- TLSH T150265C1EB36882A6D1B7D1BD89829606F771F441873156CF2294875E2FBB7E34E3A310
- MD5 SHA1 SHA512 SSDEEP TLSH