Analysis
- max time kernel
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 06:40
Behavioral task
behavioral1
Sample
2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 2.4MB
- Sample260717-hfdtnagy6z
- SHA256 e040bada5c54ca5eb1065d451d5ae067f4dddbaffdf75526ecda2eb42d97529b
- MD5 256c51c814dd450116b57ce7ec26db28
- SHA1 19fba7cfd45277e60adcc35e7ffed69604297106
- SHA512 b85f7c4e8a604b3c88c163ce49f7a2ff0dafa8cf1f0a162b6131cb66265b185d2f5a81a080ff806d2b77253900d42becc3956d4f06b4c5ecada2dfada00b3c85
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/7YYTqMi8CtBd2QHCHmTBW5DsDPjHg9PnNUcQN5jcG:T2agnTkLfU7qJtb2IrPjH+PIjpYq
- TLSH T16CC55B25F6B486A2D0B3C475CDD29646EA323C810B308ADF5299B36D6E337D19D36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2624-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5d7-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2624-15-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2876-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-437.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb50-443.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ab10-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac03-1233.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5d7-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-437.dat aspack_v212_v242 behavioral2/files/0x000200000001bb50-443.dat aspack_v212_v242 behavioral2/files/0x000300000001ab10-948.dat aspack_v212_v242 behavioral2/files/0x000300000001ac03-1233.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2876 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2624 2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 2876 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_256c51c814dd450116b57ce7ec26db28_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2624
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2876
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 e040bada5c54ca5eb1065d451d5ae067f4dddbaffdf75526ecda2eb42d97529b
- MD5 256c51c814dd450116b57ce7ec26db28
- SHA1 19fba7cfd45277e60adcc35e7ffed69604297106
- SHA512 b85f7c4e8a604b3c88c163ce49f7a2ff0dafa8cf1f0a162b6131cb66265b185d2f5a81a080ff806d2b77253900d42becc3956d4f06b4c5ecada2dfada00b3c85
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/7YYTqMi8CtBd2QHCHmTBW5DsDPjHg9PnNUcQN5jcG:T2agnTkLfU7qJtb2IrPjH+PIjpYq
- TLSH T16CC55B25F6B486A2D0B3C475CDD29646EA323C810B308ADF5299B36D6E337D19D36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 e59b0e39d92acd8c84aae7546eadbd2661c2f5aaf4432d8055cda3c24eb282b5
- MD5 4d79b6728040c92c11faa09aee2b67a1
- SHA1 78a82db62ed8b24649e9c4ee2b910ca84526ee79
- SHA512 6e24eb8af0b9f6d28844070e2cc52077cef3e7a3b043c5b5499ad7f376894bc61a1fb1c139fe4d94d1cc7761e2305a169d20a7fe17018f68c0e0789f9392ac77
- SSDEEP 49152:T2agnTkLfU7qJtb2IrPjH+PIjpYqjPji0Aj:c6br6Gjo
- TLSH T191E54B26F6B48771D0B3C0B9C9D2964AEA323C810B308ACF5295B76D6E337D59936731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 2.4MB
- SHA256 a7d3c5e9e679569ceb6cbd289d092acf05ee2c19a3e7f8662c1ef78eea755d94
- MD5 d7ada24ae633f4e2f87b23781dc56955
- SHA1 08f54f82cc38fd301705db4de9faaa77c2d1a88d
- SHA512 829e4b79d7358420547cf1b7249c238921dd8cf477711349f16563ca3a59214bb8ca4d9e528f49cf659ea983d31ed45c876a4515a2b1f6e0e3dcafcd350c66cf
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/7YYTqMi8CtBd2QHCHmTBW5DsDPjHg9PnNUcQN5jc/:T2agnTkLfU7qJtb2IrPjH+PIjpYqW
- TLSH T1C5C55B25F6B486A2D0B3C475CDD29646EA323C810B308ADF5299B36D6E337D19D36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 2.4MB
- SHA256 fcc8d0e57ccdb057050146f61d28f1174baac85854c0b86082f560f333e23892
- MD5 d3b569ec2124ebd83b5746651fe71636
- SHA1 3bdda289de30d2555a25a80dfe0d3b6bdc027538
- SHA512 7e7de6003c1dd76b9b51d00d93afffd36a9cefedce9615fafb25e1c9ee25c01c90ac609e6c0609452f86def3c2643fa3c1fec0c46042b7f05192c8fd6a53b651
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/7YYTqMi8CtBd2QHCHmTBW5DsDPjHg9PnNUcQN5jcT:T2agnTkLfU7qJtb2IrPjH+PIjpYqW
- TLSH T1C4C55B25F6B486A2D0B3C475CDD29646EA323C810B308ADF5299B36D6E337D19D36B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
- Size 3.2MB
- SHA256 18e1dde7bd67f3ee056acfcc129e72a6b5f540aa5fca27b1f929681cea4d2020
- MD5 5fff936e01b914c976a178bb336a4ad5
- SHA1 7128a9afcd256494a6bdbcfbb757386150485564
- SHA512 f47e74facf3bd9a8c384f5175982bca7ee2ad9711820daf900ee8e1bfc186d2d81a204f90d2fe200b5ff2255d4029a0480e5a1d11b85b14210971a967ff7fedc
- SSDEEP 49152:T2agnTkLfU7qJtb2IrPjH+PIjpYqmuygmUSbHDUnT:c6br61UEW
- TLSH T15CF54A51F7B846A1E0B3D574C9A29665EA727C920B30C6DF0294B32E1E337D19D36B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$
- Size 2.5MB
- SHA256 d0becd44c2dc14c70d1a37ed54e66de94b428009de929c77f627164e098e9415
- MD5 1e4838e00398351574e53661e5a933bc
- SHA1 bde40b93f5125c7379031c84e29f0dc2b71f04c1
- SHA512 62fe81ab0a8bdd2a9ff95d7e059a7e0c031c31b0d49a86f0424f79a4d0cf7c534e75414dd87bfbca2b6e3984727d6733b50f25ed6afbf173985e779f1a14ce91
- SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU/7YYTqMi8CtBd2QHCHmTBW5DsDPjHg9PnNUcQN5jcE:T2agnTkLfU7qJtb2IrPjH+PIjpYqt
- TLSH T149C55B21F6A486A2D0B3C475CDD29746EA323C810B308ADF5299B76D6E337D19D36B31
- MD5 SHA1 SHA512 SSDEEP TLSH