Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 11.2MB
- Sample260804-lz5chasyey
- SHA256 98a6c0902b070109609db71b98bb1fdebd874f745bc856fa435876e03e69b625
- MD5 bc32564f8b882ca9e813ee62c08128fe
- SHA1 df89d981364b6a77ad90e7a645f15d3396547fd2
- SHA512 412ad97638ed00b4207c2ff3dc71259d1b16a90c5f0923ee9f8b020f80465ef83aebb5603241673e4349f0457772ae16897e898980a2420e07e0cf45e8a57f6d
- SSDEEP 196608:Su5oddH66HtIto0ADHeGZBWyZ/K0ttYVAATa:6O6YoL8yZ/K0ttYZTa
- TLSH T15EC65C55B2B325BCC21B9474856DDE33BA303C555BA05DFB2180E6F02D36AE47A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\print.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tree.com 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sudo.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\help.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\net.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\r\smartscreen.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\MRINFO.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\r\AppHostRegistrationVerifier.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_bcd933e3a6b2aaa4\mscorsvw.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.26100.1_none_ff9d2f602c1cc7f1\sapisvr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_9d6b1e2831f6fc5c\driverquery.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1_none_71d0d2e420e01cfd\provlaunch.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\r\wermgr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\FilePicker.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\typeperf.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\r\DataExchangeHost.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\r\FileDialogBroker.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\TiFileFetcher.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1_none_1722516902407be3\rasautou.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_6afaa980b9711021\SystemPropertiesProtection.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\sdbinst.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAgentPolicyGenerator.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\r\slui.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\cleanmgr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\InetMgr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_95cced994cad782c\BackgroundTransferHost.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\NETSTAT.EXE- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.26100.1591_none_29e868b2edff462b\r\AccountsControlHost.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.26100.1150_none_e30c7c3aa9b12724\Dxpserver.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\rstrui.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\ThumbnailExtractionHost.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\WSReset.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\WSManHTTPConfig.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.26100.1742_none_83617bab44bfd415\securekernel.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_6c3a7829113ddd25\rasdial.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\r\WindowsUpdateElevatedInstaller.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.0_none_107a08446d17dcf2\aspnet_wp.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\r\Utilman.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\r\FileExplorer.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1150_none_00fe88f91f962b70\gpscript.exe- 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_bc32564f8b882ca9e813ee62c08128fe_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 12.1MB
- SHA256 8237eda9d24a33045cbf9606998a50a41b587bb23bbd5c782b5fdfea8a0b28df
- MD5 fd06590e98f92c93f14dc94695826764
- SHA1 0d4c03642c46360a7a75e1866fe8388a6c136899
- SHA512 c3bd95f31a6d33afe00dc59f58f80db22f89c55b0c863d0bdcebd9f761efa21e1968d0ac8245e9b392387b107202c7016000dfb3c3e815c4b3c2b6ed7dad23d9
- SSDEEP 196608:Su5oddH66HtIto0ADHeGZBWyZ/K0ttYVAATYw:6O6YoL8yZ/K0ttYZT5
- TLSH T1EFD66C55B2B721BDC21B94748569DA33BE313C550BB05DFB1180E6F02E36AE47A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH