Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 22:13
Behavioral task
behavioral1
Sample
2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 9.3MB
- Sample260804-149kca1frh
- SHA256 ccf41539fac8aeae081d6660d56e4cec826434dff645fc1b0b9defb2d6dbeecb
- MD5 d71ac53032fc8f162c5aa03b78e98d00
- SHA1 e367e7119b19469b6e65d847186da7aac8454f10
- SHA512 34526efd28346c36e482f3085faf614977628376dac2bf838d73c5ae18d43af2a227cf42555d19168b5fedb9a7def357b2c262fcb6172e70bec82cbf06caaa30
- SSDEEP 49152:K8MKzq+9MIQkETwgjI45TMwwapIgTGpYqMgjI45TMwwapIgTtT3S9tsgX8zEC8UI:vak1LapIJ6FLapIyTIOSAoLapIkjol
- TLSH T1D1A63A2272F10466D1AE913ACF61463597E13C7E8FF2C3AB7104B2D91E726C17A2A717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c523-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c523-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/1968-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c523-5.dat upx behavioral2/memory/1968-473-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1968-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\InitializeRestart.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\directxdatabaseupdater.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFHost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingShell.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\pacjsworker.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\SpatialAudioLicenseSrv.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\r\dsdbutil.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icacls_31bf3856ad364e35_10.0.26100.1_none_2fa847710e86cbe0\icacls.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\MsSpellCheckingHost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthService.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\wermgr.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\r\WpcUapApp.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\StartMenuExperienceHost.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\MRINFO.EXE- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\HOSTNAME.EXE- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\r\EoAExperiences.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\logagent.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\r\PrintQueueActionCenter.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.26100.1_none_2d66dab1a4ca9883\SystemPropertiesComputerName.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1_none_1a35ff092a421b8f\rrinstaller.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\r\sfc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..eapplifetimemanager_31bf3856ad364e35_10.0.26100.1591_none_02ccdf13e86dfcfe\r\RemoteAppLifetimeManager.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\rdpinput.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1150_none_1763b5dd5aadd1af\dpnsvr.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmplayer.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\TokenBrokerCookies.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_9c81814c454e23f1\vbc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCM.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_cb7026b6ea62c346\whoami.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\WmsUserAgent.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.26100.1591_none_8055c40aa3ab24a2\NetEvtFwdr.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_754be8247547f871\esentutl.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_d71ac53032fc8f162c5aa03b78e98d00_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.2MB
- SHA256 e50310c8d9e916015e5c6d5f7c59d6486be23ecf19f6ae36e38707f13498eaab
- MD5 ed93c69cb67b65e00ed20cf72fda2dc4
- SHA1 05c6bcfc45017a14601c36dab0b3789f69b0ab4e
- SHA512 15a43ee9cb21d1c018720286567e84a82eeafce55020f61c7e2614769d702605d0373282309f4d833b23083160a866430449d4eb5a34d1881ea527464c9c5fdb
- SSDEEP 98304:vak1LapIJ6FLapIyTIOSAoLapIkjo6ezSC6v2XMHl:vD1cIJ6FcIyTfscIuox2
- TLSH T181B64A2272F10566D1AA903ACF62463497E13C7A8FF1C3EB7105B2D92E726C17A36717
- MD5 SHA1 SHA512 SSDEEP TLSH