Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 02:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 7.4MB
- Sample260803-de3deabc43
- SHA256 3d6cfdc5888c65bf5782c96fe3d6742e6f490d2809da815b3d39beb6673adda2
- MD5 19c524ecbbd2980b458d3db353d46900
- SHA1 8d3c71f88ce5889ddf4ec0923063f21a3316bcbe
- SHA512 b725326c059828b0ed53d0ee39d46c375f1ae1158155a7ea853c344ee4c6cc1f8f3bbf5bee31cb44634c61870de6234ba9ac171bcd51e6026810b21397d078a5
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAojoY:Su5oddH66HtIto0ADHeGZRoY
- TLSH T1D9764BA47273357CC31B9878406DDE73BD3028551B509EBB91C5DAB02E17A68A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\at.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\help.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tree.com 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\logagent.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.1237_none_4b16fb7fab206eb1\f\printui.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\r\raserver.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\r\prevhost.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.19041.264_none_7a40d01e6ba302b9\mfpmp.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgrsvr.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.19041.844_none_5308232e9343b869\r\WinBioDataModelOOBE.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.264_none_9b70177c85a8df54\mavinject.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\r\sethc.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.1_none_126d541494a0ae5b\CCG.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.19041.746_none_d99fd60bc1fde773\r\LockAppHost.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.19041.746_none_38c6194376a6b88c\VSSVC.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.19041.1_none_db0db48be3885975\VMImport.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\r\gpupdate.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\r\fltMC.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\f\wininit.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\OpenWith.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_76ab6db74ef1e15e\waitfor.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_c7a124154e1d7314\mtstocom.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager-shared_31bf3856ad364e35_10.0.19041.1266_none_7916f7558927ae23\f\hvsiproxyapp.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\wksprt.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-where_31bf3856ad364e35_10.0.19041.1_none_1e18f0f5b1e8db7d\where.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_248d91ddf4389abd\CredentialUIBroker.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\r\rdpsign.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\SearchProtocolHost.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\SpatialAudioLicenseSrv.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_d27e617a9bd9c1d3\ieinstal.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_b435e08254cda322\printui.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizard.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\vdsldr.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\XBox.TCUI.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\f\Microsoft.AsyncTextService.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\PerceptionSimulationService.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.19041.153_none_9fd3a313935e2396\r\upnpcont.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.19041.1_none_6c56c3651a911f63\waitfor.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_c8deb9da2cb2458a\rrinstaller.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_bd769d14dfd7d29d\f\sdbinst.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\cscript.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFault.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_ea34e25ca28496c3\tzutil.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\tracerpt.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\f\DeviceEnroller.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\diskperf.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\f\backgroundTaskHost.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-core_31bf3856ad364e35_10.0.19041.1110_none_29d8ec742bfd8b13\r\fhmanagew.exe- 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_19c524ecbbd2980b458d3db353d46900_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.0MB
- SHA256 d299e98aaa5463afc1fc1878cc8aa6a8e1256f9bdd429f05102018aece9cf91c
- MD5 5a0e931f4aeefdaa308847bac8bbec6d
- SHA1 8add8f3d7b99b41708ba4ae1316653c4c0e0aae1
- SHA512 f138b024a84c6ac20fc26d4ef1ec5fc0f6acac4868081496ca8bc0644e03018d371d5e795261da1ac49eacacf1e5d69d00ecd92047173162b1773f2e223d68c7
- SSDEEP 98304:kIOu9joddSUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGawxQeMjLsAAojoQjo4:Su5oddH66HtIto0ADHeGZRoio4
- TLSH T1AA865BA47273367CC31B987880ADDE73BD3024551B509DBB51C5DAB02E17A68A92FF32
- MD5 SHA1 SHA512 SSDEEP TLSH