Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 20:13
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 5.7MB
- Sample260804-yzpy2adn6x
- SHA256 0941b1a1ce57ba361afdfbe952ed487446512cfb491a547f9b5246468a9ea369
- MD5 54b26343924f22e0d2942622fe3b6a5c
- SHA1 8ae40c52d731f02193ca94d51a1b2845ec332964
- SHA512 e381cf1a89984cfcd1ee3e30f71fc67feb1721e20ec0a9cfd8a9f4476c53110383e29807b7dc6da9190ee6b7b01b2133ce7fc350f00bdab2c84aa768e5ef0ee2
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQS:kqiR3TIOSAzLapI1joES
- TLSH T141564B2272E44526D16A913ACF614A3997F13C3A8FF2C39B7104B6DD1E727C1BA26713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x000a0000000243e0-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x000a0000000243e0-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\esentutl.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\chcp.com- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_4.0.15805.0_none_dc3886319c616739\MSBuild.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.1_none_1f721a9c9befed5e\SyncHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\r\GamePanel.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\setup16.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.746_none_680d56683fad152b\f\isoburn.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..deploymentmgrclient_31bf3856ad364e35_10.0.19041.1202_none_c26e06f4b82585b5\r\dmclient.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.19041.1_none_075470a68fcfb411\umount.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\r\UsoClient.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.19041.1_none_fa5853083f6020df\aspnet_state.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_4e633e7ac2500190\mspaint.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.19041.746_none_cabafbc5834ab93f\DisplaySwitch.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.1288_none_e0f8082a6952ce81\r\ntoskrnl.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\ByteCodeGenerator.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.19041.1_none_a18558d9ae23205d\scrnsave.scr- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.19041.1_none_ba28e703f717d172\wlanext.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\r\PrintBrm.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_edd345b6c42269da\r\rasautou.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_b6126993bc8370e6\SMConfigInstaller.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1_none_52c6583f47afba7a\autoconv.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.1_none_513ebdc8ffa81e3d\coredpussvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSMKUFIL.CMD- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_c2a2211ad648e627\f\mstsc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\r\svchost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.19041.1266_none_7e2b6be969016c27\licensingdiag.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\f\winlogon.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.19041.1_none_1b1c6505d69885a4\SystemPropertiesPerformance.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1266_none_ccf6cb6d0aa9a822\mstsc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.746_none_476e348ff3b593af\cmstp.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.19041.1_none_fc9bfaeba32d6cd5\dpnsvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\r\IcsEntitlementHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\tpmvscmgrsvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.19041.1_none_fad1fa0072ef4a3a\IMEPADSV.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.1202_none_23a707c9a0b5a8e1\Taskmgr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_7d1b4a535854fe42\quickassist.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_9c23b4a33898c817\isoburn.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\tabcal.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_39eaf2470cfe88f0\f\explorer.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.19041.746_none_dfcf5b6f69f16f7a\f\rdpclip.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.964_none_dddeea757b7fbba7\r\ssh-keyscan.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\f\wevtutil.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.19041.1_none_b22e8a4512f5879a\WFServicesReg.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingSvc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizard.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.19041.1_none_9b6f5274d7a3ac24\extrac32.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-tetheringservice_31bf3856ad364e35_10.0.19041.746_none_6ba9668b45cb4938\IcsEntitlementHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\f\cmd.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\f\gpscript.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1266_none_e40ca34e5de298c9\r\rasdial.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\InputApp\TextInputHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\r\control.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.19041.1_none_aa4f3617632d6024\comrepl.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.19041.928_none_85ac1b118ff2a924\dxgiadaptercache.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.19041.1_none_c719fa2e662738e0\WPDShextAutoplay.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 6.2MB
- SHA256 74ff509a1da8966191be25ee3340d2e4fa0daeb3311751227adbfd8edfb119c3
- MD5 cc03e6019dec7948d0fe6e91fb325e06
- SHA1 b0e4d0817cbdce33f70474b1fd14d627f21eb483
- SHA512 f6ee41f2438309a2b7b9d241015cd581b8d35c384dc3e593cfd92525ee3ee2a0c2b19f6b2367d111b0e3a8fdd5bff3e54c524b5387980e1f5637f41224d70205
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQgPjF:kqiR3TIOSAzLapI1joEejoQ
- TLSH T1B1665C2272F44526D06A917ACBA15639D7B13C2A8BF2C7CB7104B6DD1E727C1B636323
- MD5 SHA1 SHA512 SSDEEP TLSH