Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 03:11
Behavioral task
behavioral1
Sample
2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 19.0MB
- Sample260803-dpsa7axeng
- SHA256 5f749e8e1ce5440030569d4266b4113e4339b226f3fd20ee988811ffea7f7bfc
- MD5 b67b2a5bf4e4c26bd27d51a2a4a1fd80
- SHA1 7315c4187b8d806c0de3d52e8a2de57a66950417
- SHA512 b9f3d5830b7f1c7acb6554b1d9b291289c2e77e12268bc9d77b6a9a751209426b4881654fd16f39155a473ee3de849944e23cf03a3d5730694a4a1fa5a336af1
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06jgTH2qBpu1QfLIqsuf2rF:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0S
- TLSH T1E8176C12F2E44BA9C06FD078CA426665EA733C454F709BCF5544BE683E376E06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024250-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a000000024250-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral1/memory/2040-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000a000000024250-5.dat upx behavioral1/memory/2040-340-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/2040-3216-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\regedit.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9c79736d61efaf52\imecfmui.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_c991318e4b11e4cf\RMActivate_ssp.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15805.0_none_c8f9d36146564b7f\aspnet_regiis.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\e374984536e5d701109b00001815341f.iisrstas.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\hvsimgr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.84_none_f9792ddb393f9467\rdpclip.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.19041.1_none_4caa24969a02f9c3\timeout.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\f\slui.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\explorer.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.264_none_40d14f6c04397868\agentactivationruntimestarter.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\r\FXSCOVER.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_3f7ee0a8ee28ef7d\netiougc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.19041.546_none_1d38815769c81e5a\r\dllhost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1110_none_0565d41cd46ec20a\msinfo32.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\r\Dxpserver.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1237_none_9d556cf140e198b4\f\RecoveryDrive.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\r\autoconv.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1_none_3e1c0a49448926c6\bcdedit.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\winlogon.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_18e6b82c93a9c5f6\xcopy.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.19041.1_none_0e6389fff73df783\expand.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrs.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_76eb13d6387f99ed\csc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.19041.1_none_b977d9566df127e9\wmpnetwk.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15805.0_none_429bcf7adb8e23ed\AddInProcess32.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\f\Microsoft.AAD.BrokerPlugin.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_fbaeb6d5afb287f7\gpupdate.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.19041.746_none_b8eadbf8a9c907b3\f\psr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\eshell.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..environment-windows_31bf3856ad364e35_10.0.19041.1202_none_ddf8c4144200f5b4\winresume.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\rasdial.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.19041.1237_none_665f7346099d6350\r\bdechangepin.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\SpatialAudioLicenseSrv.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\f\wiaacmgr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\user.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\djoin.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.19041.1151_none_2e15548db03a22c8\f\CheckNetIsolation.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\audiodg.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\f\SystemSettings.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\f\OOBENetworkCaptivePortal.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\f\SppExtComObj.Exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\b719614236e5d701619700001815341f.uwfservicingscr.scr- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_3062feae2a702d0a\cliconfg.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\f\SearchFilterHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\r\coredpussvr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\runonce.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.423_none_c3eac275ecdf7e0a\f\NgcIso.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_edda8130b19d4286\CHXSmartScreen.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1_none_65637d0d99e451f6\DeviceCensus.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.19041.1_none_6e0e425bd0e83959\shrpubw.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 19.5MB
- SHA256 c35c169ffb3676f709c786f9d6099114b5e5a309e2581767761e7c1f1d34e7c7
- MD5 620a21f8b4cb060d50887793c9a8fd37
- SHA1 26838dffc329e01ce34fd66b5128356a030f890a
- SHA512 2ca454c88322d284a38fc219914b902790a8d18cd2490c2d4b8cccd0eb63f839ab165f5279fd9e7f12352b5fd8a1ea68c17792bcb32f9638e1b973de37f54108
- SSDEEP 393216:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0Xq:ERXMzXdyZ/K0trFC4QReHNBpu1Qfc0Xq
- TLSH T136276C12F2E44BA9C06FD078CA426665EA733C454F709BCF5544BE683E376E06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH