Analysis
- max time kernel
150s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 6.9MB
- Sample260724-ydldqa1gnd
- SHA256 2f2df45383574484d40635159d94eca1b2b30d6026f67ff1403d3e6c73691f88
- MD5 2052db5a213dda44587fede20c8e78cf
- SHA1 0ee4f859b00714aa313c7a80e01f335cf8228e73
- SHA512 ff10f7b2d26add4abcd16003c9317b04bcea7182251908b117086496819aa9b7a97b301efc1c3c5dace8bbda755f1fd0fc8b309e0393826da5e6fab493ccd25a
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAF:Su5oddH66HtIto0ADHeGZQ
- TLSH T184766CA472B3397CC31B9878406DDE73BD3028552B509D7B91C5DAB02D16A6CA92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mode.com- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\more.com 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sort.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\doskey.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tree.com 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\where.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\newdev.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\recover.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fontview.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\r\msinfo32.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasphone.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\r\CertEnrollCtrl.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmdl32.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\reset.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\pcaui.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\CompatTelRunner.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXLauncher.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\EduPrintProv.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recdisc-main_31bf3856ad364e35_10.0.26100.1150_none_20634ae8638b2e34\r\recdisc.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\BrowserCore.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\sethc.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_597aa4330f646c5b\net.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\iexpress.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.26100.1_none_17ee58fea8875a62\wmlaunch.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\r\SpeechUXWiz.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ARP.EXE- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\windeploy.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\imecfmui.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.26100.1_none_36d761739f8fd1b7\vbc.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\WpcTok.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\PickerHost.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\winhlp32.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_14d2f3235b5beec5\msdtcvtr.bat- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\dialer.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\UsoClient.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\lodctr.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.26100.1150_none_6cd729c157564f7c\r\WinRTNetMUAHostServer.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8d5ba08151885bf2\recover.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\dwm.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1150_none_96f4f35e249cde0c\wecutil.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\tabcal.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\r\rrinstaller.exe- 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_2052db5a213dda44587fede20c8e78cf_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.8MB
- SHA256 6a3b4b5b84f2717cbfcef2b0f5e8df5da98aa8182177ba95bd070300659fb30c
- MD5 95aaa702b160b1c90294249f2480fcaa
- SHA1 7236414cb1507984fd7d2467cf7e8f3feefb6164
- SHA512 c12a2f8decb780b6e0c33362128bc8020d4ea120ee35e2c0323a6285cad664acedfeb1540e70dc4ba25f0f45a236ea4b9b9526a6d986c64c7ae0681591de29c9
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAaezSC6v2XMHB:Su5oddH66HtIto0ADHeGZ2O
- TLSH T18E865BA47273367DC32B987880ADDE73BD3024551B508DBB51C5DBB02D17A68A92BF32
- MD5 SHA1 SHA512 SSDEEP TLSH