Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 00:07
Behavioral task
behavioral1
Sample
2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 13.2MB
- Sample260716-aeq4lab181
- SHA256 fbc3070f14d63b11569e8f3bec1bd004379320b26a18bb6d127c8187333195c2
- MD5 408fcf4f6fdae5f780ccbccf2b9b3443
- SHA1 43168a25bfd46fa7888aad76f998df5f6efdf577
- SHA512 af4c300189acb6b5a659cce93ae86e6a7f6b4e8b907a30b6ec48f6971604b56af73117f206422e2fc84e97df809c26782206c029ebbdff7cd957834f6a8f9358
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06IG:ERXMzXdyZ/K0trFC4QR/
- TLSH T1B3D68E13F2F44266D076C179CA929629EB713C564BB0C6CF6158F3AC1E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001b87d-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001b87d-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5404-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001b87d-5.dat upx behavioral2/memory/5404-350-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5404-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\LogonWebHostProduct.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_db738856a624fee8\help.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_9493bccc1124c937\mshta.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_0133b87cb28b767b\takeown.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1_none_f4516e08d8dbd686\w32tm.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\CloudExperienceHostBroker.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1_none_49050f53b3863739\EhStorAuthn.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1_none_18be9e06ed967433\newdev.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.26100.1591_none_5d054cd1bd51eff3\DeviceEnroller.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_597aa4330f646c5b\net.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_705e51669f200004\powershell.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\msiexec.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.26100.1150_none_dad1c69b80d09caa\r\CloudExperienceHostBroker.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\r\scrnsave.scr- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.26100.1_none_c811e1884be875a8\AddInUtil.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\fc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-klist_31bf3856ad364e35_10.0.26100.1_none_3e2848112f1873ed\klist.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.26100.1_none_9aadb670a9451e5d\RpcPing.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\powershell_ise.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_c435ce459c01d610\mscorsvw.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\SnapLauncherProtocol.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\dsmgmt.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\LockAppHost.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\ResetEngine.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_4c51727a891ced07\r\credwiz.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_ec5dcd352cf057e6\aspnet_regbrowsers.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\prproc.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.26100.1_none_fd15047085b284f0\SMConfigInstaller.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\r\dsdbutil.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\r\DevicePairingWizard.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\winrshost.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.26100.1_none_cc7ea73da7f4750d\snmptrap.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\r\stordiag.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.712_none_b1d1fad188ff9ad7\r\PhotoScreensaver.scr- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\unlodctr.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmdl32.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\WPDShextAutoplay.exe- 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_408fcf4f6fdae5f780ccbccf2b9b3443_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.1MB
- SHA256 08e05814084e4bd4ebf138ef27015ebcc1ab40926b37c71f21562df05d48d1b7
- MD5 82722e3fda622ad56e2b5891febcd300
- SHA1 c30a0cc64ca7e54166c7b16e239f6d192a9ed675
- SHA512 95a1796131f77c9832843055adbcdc510469907cdf1356dddfa8a85a8a90fb0259c0dc9304b90ea50df3f36c2f6182ae3bb9d0e9fe895030395507ac97f91381
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06IUS:ERXMzXdyZ/K0trFC4QRO
- TLSH T195E68E12F2F44266D076C179C6D29629EB713C564BB0C6CF6149F3AC2E377E1A639322
- MD5 SHA1 SHA512 SSDEEP TLSH