Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 7.7MB
- Sample260730-bzvsyswhnb
- SHA256 29e2a87654eb4b3d75fcee588db8a4c6e0ba3983713a0ef5d590e55889d3fbf0
- MD5 1a39141419397ec77a8a351d9e67a3a6
- SHA1 aa7513eefe4dece399139f0517e1d3507c4122bc
- SHA512 704a3cd0a4fd4a05632fe08762fbbe243905bebba746acf05ed68086d24de04f9be2380a2a1c822cc62c90a690d729cad5cced5bd1b5a3922cae1d2f52496259
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAA0fkZcT:Su5oddH66HtIto0ADHeGZ/PT
- TLSH T186865BA47273367DC31B987880ADDE73BD3028551B508DBB51C5DBB02D17A68A92BF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\systeminfo.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Robocopy.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\print.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\where.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cmd.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mmc.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\runas.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.26100.1150_none_15f982365a9d2243\UIMgrBroker.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\iexpress.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1150_none_8be227bace421d8d\r\cttunesvr.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\r\Windows.WARP.JITService.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\perfmon.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\MuiUnattend.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\r\PinningConfirmationDialog.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\r\scrnsave.scr- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_acf5850f76c86db8\r\WPDShextAutoplay.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\esentutl.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\AtBroker.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFHost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\r\esimtool.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\r\UserAccountControlSettings.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\bfsvc.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchProtocolHost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\ScreenClippingHost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchIndexer.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\FileHistory.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_ddaf5dc661e91ea5\aspnet_state.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\SpatialAudioLicenseSrv.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\r\IEChooser.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\UpgradeResultsUI.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\imjpuexc.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\r\pcalua.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\r\wowreg32.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\vmwp.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\LaunchTM.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\r\AtBroker.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\DevicePairingWizard.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPDCT.EXE- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsvworker.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_877dba7dc10bf8a0\RmClient.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\CCG.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\r\SystemSettingsAdminFlows.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\change.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\lodctr.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\ScriptRunner.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\r\nslookup.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\esimtool.exe- 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_1a39141419397ec77a8a351d9e67a3a6_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.7MB
- SHA256 a4a568736fe53f71e7c5dae64e85a7b355ea964dbc0d159b1d43bc97a7c6c619
- MD5 ebb8bdf680a99f10bd0723accac6eaf4
- SHA1 32db6f10a8d9f6b041f1f79f700cb5963bc44831
- SHA512 e88a14da9b68bea1b902fd28363b2dbab3f80fd8c612aae649373eb8d372e453f959775cb460a0ffbe48a9b7861b64057b2a729d3872b8ace85bd8c4e3f43cb3
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAA0fkZcIezSC6U:Su5oddH66HtIto0ADHeGZ/PfD
- TLSH T14E966CA4B273767DC22B847880ADDE73FD3034451B204DBB5185D7B42D17AA8A93BB36
- MD5 SHA1 SHA512 SSDEEP TLSH