Analysis
- max time kernel
150s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:08
Behavioral task
behavioral1
Sample
2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 23.1MB
- Sample260803-dm86xsbd39
- SHA256 5a1b43dc0f10266f5948dca4eafa85f71fad5087e2002df4e9e112a5ec455aa1
- MD5 d14a503771f574392dc20f7df432b588
- SHA1 dde9d05fa1dbad91b69ece4f35633b550ee19af7
- SHA512 d4f4436eeabc87800eaf5deb24a93377418867034cdc98c24fc99c792b84895cc03882f298a4ab9dac07e58cf0804c4dd039acfc7ea42ffb25c5b5a9895dfbcc
- SSDEEP 393216:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0XyZ/K0ttYZTz:ERXMzXdyZ/K0trFC4QReHNBpu1Qfc0Xj
- TLSH T10C377D12F1E44AA9D06FD078CE525665EA323C454FB09BDF1544BEA83E376E06B3831B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Custom signatureDetects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4cf-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/5600-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c4cf-5.dat upx behavioral2/memory/5600-233-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\print.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\dialer.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\r\WmsSvc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_d5e7146d665097c0\ngentask.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15912.0_none_5cfe50bb9b6405ea\DataSvcUtil.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackupClient.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.26100.1150_none_e9952a81b2d9169d\r\dmclient.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_57ca55906b66d7b3\SystemPropertiesPerformance.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.26100.1150_none_3cdcbfd9e162066d\RMActivate.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\AppInstallerBackgroundUpdate.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\showmount.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.26100.1_none_55d78c384ca248d1\csrss.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\LaunchTM.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\r\DmOmaCpMo.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\hvsiproxyapp.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\audiodg.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgesh_31bf3856ad364e35_10.0.26100.1150_none_648c8216bc35a3e5\MicrosoftEdgeSH.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\unregmp2.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\vmcompute.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upfc_31bf3856ad364e35_10.0.26100.1150_none_430cd619cc4d0de3\upfc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFCompanionHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1150_none_7e5b72d9f82ad1d1\hdwwiz.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\BioEnrollmentHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\r\ksetup.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpinit.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\conhost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\r\directxdatabaseupdater.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browserexport.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\BitLockerDeviceEncryption.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\AggregatorHost.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\hh.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\directxdatabaseupdater.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d14a503771f574392dc20f7df432b588_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 24.1MB
- SHA256 41dd65e757b63e02efa753fd4b18c37d8503a17195fabca38c68411219c39a27
- MD5 175fc8e983768624bf6d05c37aba5637
- SHA1 da95de360ab7ffbd11af6a68f63619f4df13561b
- SHA512 233138e7df858575d134952106f6f64389ed2b1aae03fd32e15e72af3712596ff60affc691a24ab74535d547dbab27ee1919c80376c1c2f9d64573377cbee7d9
- SSDEEP 786432:ERXMzXdyZ/K0trFC4QReHNBpu1Qfc0XyZ/K0ttYZTJ:ERXMzX0Z/K0trFC4QR8Y7Z/K0ttYRJ
- TLSH T123476C12F1E44BA9D06FD078CE525665EA323C454FB09BCF1544BEA83E376E06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH