Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 16:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 6.9MB
- Sample260723-t7vr2aca26
- SHA256 46d9b1c570adbf3485361a6cc427339b05f90f4d732ff764da76ad2e961af757
- MD5 ea3afd5444032b5cde44cf17006d50f4
- SHA1 afb6e8c76bfa46f064661cbd4081edbab4aee36c
- SHA512 18e1180b55f98deb6882876a8a6136c008f30518c3a8421d173dcb19ba213fd2498513b08a6cfffaf244a2a043a2d1798457738d566423a33d67e9ed5d034679
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAw:Su5oddH66HtIto0ADHeGZx
- TLSH T1FC766BA472B3397CC31B9878406DDE73BD3028552B509D7B91C5DAB02D16A6CA92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\control.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\net.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\PinningConfirmationDialog.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_3d9ee4c539dc092a\ddodiag.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_662e67cdd2014bd1\MuiUnattend.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_9f891aedaabbca5a\ilasm.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_c8691d618eec1ae9\CasPol.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\ShellLauncherConfig.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\appcmd.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasphone.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WebExperienceHostApp.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.26100.1_none_f49f0778ad4f459c\Netplwiz.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmmon32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\ResetEngine.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPDCT.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmmon32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\LaunchWinApp.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\securekernella57.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizard.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchProtocolHost.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_4842d7f26fe7b708\SystemPropertiesHardware.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\r\IMJPSET.EXE- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\fixmapi.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\TrustedInstaller.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_8633c2a132a5236f\aspnet_regbrowsers.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\PnPUnattend.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\logoff.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\r\WinBioDataModelOOBE.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\r\WmsManager.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UpdateNotificationMgr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_bdae08941820f568\waitfor.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_851b25ae6a5e3057\dpapimig.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1_none_18d76879146fa99e\TabTip32.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\r\CertEnrollCtrl.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\splwow64.exe 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\dpnsvr.exe- 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_ea3afd5444032b5cde44cf17006d50f4_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.8MB
- SHA256 1924b07e6aabe78f01cf5f0ddf0842a4432f3cb4e59276a865f47f5f7215e12f
- MD5 78eaa9039bda11cf69ce1eb6f4da7f05
- SHA1 d4f5c6cd97bd706a462c30730742d238e717aaca
- SHA512 ece642427fec0754c8a0200dedc2933e7c69b6dcad01ac92a5190d347b7c169eb425dd4fac839267ba150c8f5cbabd11bf2f1f9f879496bb569da7738098417f
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAhezSC6v2XMHl:Su5oddH66HtIto0ADHeGZNS
- TLSH T179865BA47273367DC32B987880ADDE73BD3034551B508DBB51C5DAB02D17A68A92BF32
- MD5 SHA1 SHA512 SSDEEP TLSH