Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 7.1MB
- Sample260723-v5y74stema
- SHA256 8004ed17c694b936cf39c6c718fa9d4138e00678215845551b0eb2ae2031554d
- MD5 2adfb3906ac973c788110bf3975c3347
- SHA1 2ef204e8db81adf7742836c0af530f945a60e500
- SHA512 031c77368ca9c1d6abc20b26cb9b738cb60fbe26b2faa067ec8a68fa3f0a3780ad630f7f2dec40d6ec0ba163ef9dcfd3f24b22c18c0e39525bffaf8e5794bd82
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAt:Su5oddH66HtIto0ADHeGZ0
- TLSH T1D87659A47273357CC31B9878406DDE73BD3028556B419E7B91C5DAF42E06A28A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\auditpol.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\setup16.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sudo.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\calc.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\format.com 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_c319a5f63c95aa27\vbc.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.26100.1591_none_b94392693d48770c\r\LegacyNetUXHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1_none_c7e625e41024bd30\wmprph.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_6609a7146abf3e09\powershell.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\r\MBR2GPT.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_a7b1b2421ae9ec27\WsatConfig.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.26100.1_none_e3264f8001c7dc21\isoburn.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1_none_d8382bfd4459c379\WinRTNetMUAHostServer.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\explorer.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmplayer.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.26100.1591_none_85f1fbdaacd275e0\r\SystemSettingsBroker.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\userinit.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\r\SpeechModelDownload.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\r\OptionalFeatures.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1_none_b0d3de420cfbf405\iissetup.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_67fcd9ee18eb970e\r\upnpcont.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandbox.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ing-management-host_31bf3856ad364e35_10.0.26100.1150_none_c952c4f3d93cb420\r\DismHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_4deff3472ce5cb34\IMJPSET.EXE- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingMasterScript.cmd- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..lepc-mobilitycenter_31bf3856ad364e35_10.0.26100.1_none_578d9d3a73cfb479\mblctr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\EaseOfAccessDialog.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2f8b84e3f73f010f\tasklist.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.26100.1_none_0a0ceefe3c8778a8\dfsvc.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.26100.1742_none_d23b4ab50f085fd0\vmms.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\MicrosoftEdgeCP.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\r\wslconfig.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.26100.1_none_8707b3fc496a6aeb\isoburn.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmbind.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\oobeldr.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\r\winload.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\dllhst3g.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\r\la57setup.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\r\LockApp.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\r\TSTheme.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1150_none_a25df22273335338\r\ComputerDefaults.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\r\verifiergui.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\logagent.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_47183375504a1255\RegSvcs.exe- 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_2adfb3906ac973c788110bf3975c3347_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.0MB
- SHA256 5c3ccb7308f2898710900821b036c218da7bf98b23e4d2f03c36227b13ab119a
- MD5 7de48dcd9526474361f2f4fd7565200d
- SHA1 13b41a1254422e17c1041c359a5a3d78929b668d
- SHA512 50387fac3c55b6c36776b3827bc2409803638a81192e140987ec60ea911b35a78182368daf085dc87de1805d9d63258527edab95d3468c47843a3f9b564050d9
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAASezSC6v2XMHA:Su5oddH66HtIto0ADHeGZqj
- TLSH T13A866AA47273367DC31B887880ADDE77BD3034455B118DBB51C5DAB43E07A68A92BB32
- MD5 SHA1 SHA512 SSDEEP TLSH