Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 17:06
Behavioral task
behavioral1
Sample
2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe
- Size 15.2MB
- Sample260802-vmmfladj3y
- SHA256 2ca5bcd276c6f8ad29d990af08855f6faf9fe52da1898e2b6bb23b7567c5cabf
- MD5 b83db7cded3c524b3ceec9c4d54741aa
- SHA1 340652eaa7b0da17cf70f095a2f2aacb02bc9ecd
- SHA512 a39e7018f4c99de5eb1418ebfe43df0f1a61004c2f5e9d3bb63e659dc0033c48b801439531cafc71c85b12552767e7475d324fc8d68c49142c0f8f0fb8fdef70
- SSDEEP 196608:ZaHxXMZ6466HtIto0Aao9d2eGZF6bUpMBF1p/kjRm4OWi2bh:ERXMoB6Yod6IbUwF1VERmj2bh
- TLSH T1A2F68D55F263786EC34B94348019CA3379203BAD57B34C7BF88CF5B4ED2A567252AE21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\winver.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe -
resource yara_rule behavioral2/memory/4884-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c53b-5.dat upx behavioral2/memory/4884-294-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4884-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winhlp32.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\wsmprovhost.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\MRINFO.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\r\CompMgmtLauncher.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\tcmsetup.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.26100.1_none_c6d712038d260ae7\SystemPropertiesDataExecutionPrevention.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.26100.1_none_dffd701c50bad456\mqbkup.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPDCT.EXE- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15912.0_none_c2b647ba71508734\dfsvc.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\r\chkdsk.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1150_none_b60d35260c7b5db5\sdiagnhost.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\msinfo32.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\imecfmui.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.26100.1_none_b3a2a31db5fc0bbd\more.com- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\r\securekernella57.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\r\stordiag.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_10.0.26100.1_none_8e6ef7811b80d32a\RegSvcs.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\bfsvc.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\r\wmprph.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_51f10c4fde15e277\r\msinfo32.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\SearchHost.exe 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\ktmutil.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpksetup.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\wininit.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_37bb8503d92b5a7e\SystemPropertiesComputerName.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\r\vfpctrl.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.712_none_1b914f4a8d4789f2\r\notepad.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_bcd933e3a6b2aaa4\mscorsvw.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1_none_f7b54b8cda580fc5\ThumbnailExtractionHost.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\notification_helper.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compat-compattelrunner_31bf3856ad364e35_10.0.26100.1591_none_5ae89417c15099f2\r\CompatTelRunner.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.26100.1591_none_819ed9883e248be5\NgcIso.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_2dd1356526e6ef59\format.com- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmstp.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_f6e3595e2d1c0bde\XamlViewer_v0300.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\r\iscsicli.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-adminservice_31bf3856ad364e35_10.0.26100.1150_none_f64f3a9ea7a6b9a1\WMSvc.exe- 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b83db7cded3c524b3ceec9c4d54741aa_akira_amadey_cobalt-strike_elex_glassworm_icedid_luca-st.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4884
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 16.1MB
- SHA256 38c79a7fc180e87816d5d02588a5e3a0f4399a8eadb01103f8a8024191067dd6
- MD5 abb72d0dd5e59dad448554ac6e996d38
- SHA1 9b5a7d719abcd1ce5c83bbaa2fbb2fe3fa2f40d1
- SHA512 0ae075b0a90985e86014a4aaabfb9e74c042ba6aff456c1a3c3263a592ac02f4c4a30c5a90e7a94236f48186c66cf7059b397ba40f1f27a9bbb2ca03a3249f84
- SSDEEP 196608:ZaHxXMZ6466HtIto0Aao9d2eGZF6bUpMBF1p/kjRm4OWi2bd4:ERXMoB6Yod6IbUwF1VERmj2b2
- TLSH T11D078D55F223697EC34794348019CA33B9203B6D47B34CBBB88CF6B4ED2A5676529E31
- MD5 SHA1 SHA512 SSDEEP TLSH