Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 03:11
Behavioral task
behavioral1
Sample
2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 19.0MB
- Sample260803-dpsa7axeng
- SHA256 5f749e8e1ce5440030569d4266b4113e4339b226f3fd20ee988811ffea7f7bfc
- MD5 b67b2a5bf4e4c26bd27d51a2a4a1fd80
- SHA1 7315c4187b8d806c0de3d52e8a2de57a66950417
- SHA512 b9f3d5830b7f1c7acb6554b1d9b291289c2e77e12268bc9d77b6a9a751209426b4881654fd16f39155a473ee3de849944e23cf03a3d5730694a4a1fa5a336af1
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06jgTH2qBpu1QfLIqsuf2rF:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc0S
- TLSH T1E8176C12F2E44BA9C06FD078CA426665EA733C454F709BCF5544BE683E376E06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000800000001b83c-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000800000001b83c-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\format.com 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/5460-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000800000001b83c-5.dat upx behavioral2/memory/5460-290-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5460-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuaucltcore.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\r\Eap3Host.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\r\desktopimgdownldr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\r\ctfmon.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\hh.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.26100.1591_none_269260d4786a1186\wpnpinst.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1150_none_6767c467165c7708\nslookup.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\r\UCPDMgr.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1_none_3942649659baf906\wextract.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-ccg_31bf3856ad364e35_10.0.26100.1591_none_f83c41b7a549ff24\r\CCG.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.26100.1591_none_97b3f064acd38654\SecureAssessmentBrowser.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevTemplateConfigItemGenerator.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\ResetEngine.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WMIADAP.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\DataExchangeHost.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseAP.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\r\iscsicli.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.712_none_231685f601e78e59\r\SpatialAudioLicenseSrv.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..etry-client-wowonly_31bf3856ad364e35_10.0.26100.1591_none_324c8f3af62cc63f\r\dtdump.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_70acf1931a9fbc01\InputSwitchToastHandler.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audit-component_31bf3856ad364e35_10.0.26100.1_none_a3abe7a4df6b292a\AuditShD.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.26100.1_none_007a743337203bf3\wmpnetwk.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\securekernella57.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\r\dxdiag.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\ARP.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpresult.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..agespaces-spaceutil_31bf3856ad364e35_10.0.26100.1591_none_782468f07f32b467\spaceutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-slidetoshutdown_31bf3856ad364e35_10.0.26100.1_none_911934c40449e6a1\SlideToShutDown.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuaucltcore.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\ROUTE.EXE- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\RemoteAppLifetimeManager.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\ielowutil.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.26100.1591_none_538f0058df8c2519\provtool.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WindowsBackupClient.exe- 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_b67b2a5bf4e4c26bd27d51a2a4a1fd80_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 19.9MB
- SHA256 312e061373e6105ebb8dfd5d6948e79c05daaec8cfb8854e4c2f3d1d53bac309
- MD5 8730a7552edd372cd4f0eabb585c73bb
- SHA1 ebc04e207cfb63fda71562bff7f0cd44892593e5
- SHA512 bd5463b0cd576d81b5441aae5049344390f73f86744e4b1a8563f074666acb1e68c93e37532196c527b5ae3cb7da81689483b19c3d9e8f7d9d71943a91de9a51
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6iMPYTfJ06jgTH2qBpu1QfLIqsuf2rRk:ERXMzXdyZ/K0trFC4QR8THNBpu1Qfc01
- TLSH T100276D12F1E44BA9C06FD078CA826665EA733C454F709BCF5544BE683E376E06A3931B
- MD5 SHA1 SHA512 SSDEEP TLSH