Analysis
- max time kernel
148s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:13
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 5.7MB
- Sample260804-yzpy2adn6x
- SHA256 0941b1a1ce57ba361afdfbe952ed487446512cfb491a547f9b5246468a9ea369
- MD5 54b26343924f22e0d2942622fe3b6a5c
- SHA1 8ae40c52d731f02193ca94d51a1b2845ec332964
- SHA512 e381cf1a89984cfcd1ee3e30f71fc67feb1721e20ec0a9cfd8a9f4476c53110383e29807b7dc6da9190ee6b7b01b2133ce7fc350f00bdab2c84aa768e5ef0ee2
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQS:kqiR3TIOSAzLapI1joES
- TLSH T141564B2272E44526D16A913ACF614A3997F13C3A8FF2C39B7104B6DD1E727C1BA26713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c54d-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000e00000001c54d-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\appidtel.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\more.com 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\user.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wextract.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\ImportInvoke.bat 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\containerworker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\lodctr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_7d29102b8cab36a5\RmClient.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiWorker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\CredentialUIBroker.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\colorcpl.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.26100.1_none_10dfbabc1234526e\ServiceModelReg.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\r\psr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_4e3bd09ff189ac9a\aspnet_wp.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisreset.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\LaunchTM.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\r\oobeldr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVShNotify.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_9609b71ef8d18dee\dfrgui.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\splwow64.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUxStub.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\r\userinit.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\msil_c2wtshost_31bf3856ad364e35_10.0.26100.1_none_bb66eed9eb812fac\c2wtshost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_621effe29fc799ae\SystemPropertiesPerformance.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\eudcedit.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\r\PING.EXE- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\UpgradeResultsUI.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\SysResetErr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.26100.1_none_ff9d2f602c1cc7f1\sapisvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\hvax64.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_41438fbea643a6b2\odbcad32.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.26100.1591_none_ad4f10ed27892462\r\TabTip.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.26100.1150_none_21762269bb195f5b\WindowsUpdateElevatedInstaller.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_14427ce57d177902\Magnify.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUxStub.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15912.0_none_ed62602ac24399fc\Microsoft.Workflow.Compiler.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\r\TokenBrokerCookies.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1_none_1d7ec919ce94ac2f\winrs.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\r\setupugc.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1150_none_96f4f35e249cde0c\wecutil.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\mighost.exe- 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_54b26343924f22e0d2942622fe3b6a5c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.6MB
- SHA256 80ee58b48e12b68db2976797e05f8963e96a5e48242c818ed076b4231b4aea93
- MD5 8bd525e6dca14e723b793dbf0b98ecb2
- SHA1 93f4e8d785047f944e245e739338e72f3d86e6ea
- SHA512 43bddcf615ce25f823ea0e9ad4dbf9f3c02f596310957bfd95e8f5228987ff34e914b1753d1bebc41216ffff5c576e5e0d386674ad7a096193a7207e6fc9d1be
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgT+Pji0AjQT/eA:kqiR3TIOSAzLapI1joEDezSC6v2XMHt
- TLSH T155665C2272F44226D06A917ACAA15639E7B13C2A8BF1C7CB7105B6DD1E737C1B536323
- MD5 SHA1 SHA512 SSDEEP TLSH