Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 7.3MB
- Sample260730-ejxt6asxbz
- SHA256 8b32d5bc2fe12626b12a11185c0b8d772a40fd82dac9a70c7d60b84577e70f79
- MD5 055a46e9aea3a3615882dfdcf861ac3c
- SHA1 57c3a4f07730eb3836a9eee1f34ea1be556e4ab9
- SHA512 0b7a3550fd82063b7d5632e28c28239d84fb48d5f37d9cae4ad2e205b4e3e3615885c5d3e7e1c7bc29c3d3feb2d75a6ca1c5ca66edf85345af814d635291882c
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAo6y:Su5oddH66HtIto0ADHeGZv6y
- TLSH T15B765AA47273357CC31B987840ADDE73BD3028551B509E7B91C5DAB02E17A68A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\runas.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\reg.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\comp.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\msdt.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\userinit.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regini.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\choice.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\subst.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\convert.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\OpenWith.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqsvc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_8e244623f18086ce\net1.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\r\dialer.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1_none_49050f53b3863739\EhStorAuthn.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5e775e7a6735dc2c\label.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1150_none_7710eb15b3cf4c31\extrac32.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\r\dcdiag.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\Ribbons.scr- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-cont..utionservice-shared_31bf3856ad364e35_10.0.26100.1150_none_f1b736c7de0a2b05\r\CExecSvc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\r\IMTCPROP.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.26100.1150_none_de2664616a7b438a\OOBENetworkCaptivePortal.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\rwinsta.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_7845af01b543f249\RdpSa.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\r\regedit.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\services.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUx.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\r\MBR2GPT.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgusr.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.26100.1_none_e9f03efdb03c43d2\dsacls.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sudo_31bf3856ad364e35_10.0.26100.1_none_a2b1ee1b85e5539a\sudo.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\r\LaunchWinApp.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.26100.1150_none_b68ce2ecb8338725\ConfigSecurityPolicy.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.26100.1_none_ad1d52a56b0a48f7\WsatConfig.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\r\ByteCodeGenerator.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\r\convert.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\Defrag.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\wsmprovhost.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\r\regedit.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\r\WindowsActionDialog.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\TCPSVCS.EXE- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-codeintegrity-citool_31bf3856ad364e35_10.0.26100.1301_none_aeea3d3f880e8dea\CiTool.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_055a46e9aea3a3615882dfdcf861ac3c_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.3MB
- SHA256 7a72ef5ff8c1c97d3d8b4cf0d17bf0463f038126865714b214e8199dd6c68bf0
- MD5 6c719c37769dbbbe2127a3414211431f
- SHA1 d374fed0a08bd7fed6146467c69b80819bb5283d
- SHA512 33e3af16c13a6d685f5b9f674bf5f0ffa29855b760c2e63c9df64d4777c975f40d9c9aadd51fb76048facde329ffecb98aec8020517ef6f8a21396fd32b68fa8
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAo6jezSC6v2Xj:Su5oddH66HtIto0ADHeGZv6wj
- TLSH T11E965BA4B273367DC32B947880ADDE73FD3034551B604DBB5185DBB02D17A68A92BB32
- MD5 SHA1 SHA512 SSDEEP TLSH