Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 7.3MB
- Sample260730-ejxt6asxbz
- SHA256 8b32d5bc2fe12626b12a11185c0b8d772a40fd82dac9a70c7d60b84577e70f79
- MD5 055a46e9aea3a3615882dfdcf861ac3c
- SHA1 57c3a4f07730eb3836a9eee1f34ea1be556e4ab9
- SHA512 0b7a3550fd82063b7d5632e28c28239d84fb48d5f37d9cae4ad2e205b4e3e3615885c5d3e7e1c7bc29c3d3feb2d75a6ca1c5ca66edf85345af814d635291882c
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAo6y:Su5oddH66HtIto0ADHeGZv6y
- TLSH T15B765AA47273357CC31B987840ADDE73BD3028551B509E7B91C5DAB02E17A68A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\choice.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\chcp.com- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\subst.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\notepad.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\raserver.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\svchost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\getmac.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\label.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\resmon.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\net.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\at.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\expand.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\perfmon.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSAppInstall.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.746_none_3ed4d566b640ef5b\r\WmsUserAgent.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\f\SysResetErr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_b2e64138c9682982\InputSwitchToastHandler.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseNdr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.746_none_eaf7a50dc46d5592\Utilman.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\vfpctrl.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\f\MusNotificationUx.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_2dfbb21bd5166adc\LaunchTM.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.19041.1_none_5c82be53abe61670\PnPUnattend.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.19041.1_none_a6007aa58351ad08\fveprompt.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_d27e617a9bd9c1d3\ieinstal.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\cmproxyd.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.1_none_6037ee587a56d834\dasHost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.19041.1288_none_5961108733e967c9\LsaIso.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\NetCfgNotifyObjectHost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\oobeldr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\aciniupd.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\f\wmpconfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.264_none_839983ebef167c68\CredentialEnrollmentManager.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\r\FXSCOVER.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\sdchange.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1_none_245e11de2a010b62\setup.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.19041.746_none_c77d8290c75caeee\r\DataExchangeHost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\f\lpremove.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\mfpmp.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.19041.207_none_d949ad80fc4d976e\makecab.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.19041.1_none_2cda3b956fcdb26f\InfDefaultInstall.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.19041.1_none_af96916428136673\mobsync.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\_isdel.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\WerFault.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\LockApp.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.1288_none_1d22271c8cc35d4b\f\IESettingSync.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1_none_c36f57b8a28f2fbc\msoobe.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.19041.844_none_10a0a60f1ec9cc10\AssignedAccessGuard.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\f\AxInstUI.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1_none_039ee78ea24cb495\dmclient.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.746_none_0f70f5a5b71ec478\TSWbPrxy.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\r\ChsIME.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.1_none_e9d80fa364d364ec\dwm.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.1_none_c5cb0c3a04b0a5de\rasautou.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\SppExtComObj.Exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.19041.264_none_9b436d497f039d6d\r\smartscreen.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-agent.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\DiskSnapshot.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.19041.746_none_8d7110d8c33b651f\TieringEngineService.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_caspol_b03f5f7f11d50a3a_4.0.15805.0_none_f0aa60ae9c531752\CasPol.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.9MB
- SHA256 e14b21d92598ecacb34abd1bcb873ac18bb5ae8fa21c1034710d96445e35186e
- MD5 e212848d35aba1b37a34951c064b83d4
- SHA1 0513836aafd5cc8c863a2e375919ab1200ce6b90
- SHA512 ee33f533f492c9fe4c1aea3e0c29508334d7f1f527dc885a41948deb6d62f770a504bc2b044e0937d1121d827bac6a05433bd891e654eff825874e4ca3a07aae
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAo6+jo1:Su5oddH66HtIto0ADHeGZv64o1
- TLSH T199865BA4B273357CC31B987880ADDE73BD3024551B509DBB51C5DAB02E17A68A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH