Analysis
- max time kernel
149s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 03:08
Behavioral task
behavioral1
Sample
2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 23.1MB
- Sample260803-dm86xsbd39
- SHA256 5a1b43dc0f10266f5948dca4eafa85f71fad5087e2002df4e9e112a5ec455aa1
- MD5 d14a503771f574392dc20f7df432b588
- SHA1 dde9d05fa1dbad91b69ece4f35633b550ee19af7
- SHA512 d4f4436eeabc87800eaf5deb24a93377418867034cdc98c24fc99c792b84895cc03882f298a4ab9dac07e58cf0804c4dd039acfc7ea42ffb25c5b5a9895dfbcc
- SSDEEP 393216:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0XyZ/K0ttYZTz:ERXMzXdyZ/K0trFC4QReHNBpu1Qfc0Xj
- TLSH T10C377D12F1E44AA9D06FD078CE525665EA323C454FB09BDF1544BEA83E376E06B3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x00040000000232a4-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x00040000000232a4-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bootcfg.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/2432-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00040000000232a4-5.dat upx behavioral1/memory/2432-300-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2432-3208-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.19041.1202_none_1a780ff3456b7bcd\CredentialEnrollmentManager.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.19041.746_none_3db5b5ee37a4dee7\f\CompPkgSrv.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\Defrag.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\r\FsIso.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_5f22b28b2f384ed0\PATHPING.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\MBR2GPT.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSC.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_adobe-flash-for-windows_31bf3856ad364e35_10.0.19041.82_none_2358a116979cc599\FlashUtil_ActiveX.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.19041.423_none_841c30f68571c385\f\hnsdiag.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmscrub.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\ntprint.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\pcalua.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_12e3d70535675c5f\r\dllhost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\mstsc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\f\SenseSampleUploader.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\tsdiscon.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.844_none_ba2b07b5ed02761a\r\imecfmui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\f\SpeechModelDownload.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\f\wuapihost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.19041.1_none_856b4f50911c6560\DmOmaCpMo.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\r\UNPUXLauncher.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\DWWIN.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.1081_none_7dd23580df04442f\r\DWWIN.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1151_none_71aa7fdbb41824a0\ShellExperienceHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.546_none_36dd2ad842e4f8c3\csrss.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.19041.746_none_ed6c95dcd471837f\mmc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4ecd10b107da65f7\AtBroker.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_90b92bf6be625d1b\f\dfrgui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\FXSCOVER.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.19041.1_none_b00bcb3b56b3d8e3\manage-bde.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.19041.264_none_be8a8ad4892e651d\printui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\r\WWAHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.1_none_80ac2d61ac960bf3\CredentialUIBroker.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_b79f30aeb967a64a\dvdplay.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.1_none_69523ba694c053ca\SystemSettingsRemoveDevice.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\f\SpatialAudioLicenseSrv.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\VmComputeAgent.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.19041.844_none_3a7392af5414371e\f\CCG.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_816403dd2374fa29\f\dfrgui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_58ba966f5b8ade0b\dpnsvr.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.19041.1_none_9219c799710d7e86\userinit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15805.0_none_1bb0d4ac7da3bfe1\ngentask.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\HelpPane.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.19041.1_none_53029e0f94a11c6d\WUDFCompanionHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\f\mspaint.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.1_none_171488549e32a4d3\relog.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\immersivetpmvscmgrsvr.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.746_none_c3054a007d804943\r\ChsIME.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpremove.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.789_none_9beee4eb02a5f8c7\Narrator.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\slui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseIR.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_ee614da092435ac4\rasdial.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 23.7MB
- SHA256 f0b84f1c1dc86c1e840c22a7adfeb568a47fa52cdf2952bd1fa0d1476fed5f47
- MD5 5223a731724c08b259a4f277a5c20e9d
- SHA1 bb8e14e3ef934a35b134e79813cfd8b66b197995
- SHA512 7fd24c78a1e8f7f272d61cdca194428e8d21ff340fcfd58a268f59e4fafc527093ae0d4b84e8b4ed12eef665d1391ffd13ed9d4554d8fa77435b0e55681bcfef
- SSDEEP 393216:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0XyZ/K0ttYZTAL:ERXMzXdyZ/K0trFC4QReHNBpu1Qfc0XC
- TLSH T161477D12F1E44AA9D06FD078CE525665EA323C454FB09BCF1544BEA83E376E06B3931B
- MD5 SHA1 SHA512 SSDEEP TLSH