Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
- Size 4.4MB
- Sample260805-wetelsch79
- SHA256 e8185e889b9a17aa34d768e26bc1f4c525887e7d401f8c8f01c875bb81ff1f41
- MD5 a000ef639c2c9b68cf3f6286e690c495
- SHA1 0ef3e9f2571cab96f3a962ee82a6c88f0b9f1947
- SHA512 5ebfd14f6f608731117d7990eb467c812916796a63570da52d3cecc080cac7711bbaff1e92ac0c37fdf3f328554317e6a6a83b01859a42fb2ee0c6dada1e98da
- SSDEEP 49152:P/a55ecI7V+dOAlmOA5MzXq5L9uiibpJKQG:Pk67S4giif8
- TLSH T1D1265B01F7504068F8BB01B5CBBE6169F57BB8A107A491CB12C4EAFE2F226E16D71717
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5832 2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_a000ef639c2c9b68cf3f6286e690c495_amadey_cobalt-strike_elex_hijackloader_icedid_luca-steal.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5832
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 6.5MB
- SHA256 eb11a03f1569d2cf5f867c96cedaf7ac971a90b2abb0cc7a5853208e767395fe
- MD5 139d5d3562c25a23ede34dd80527f0d2
- SHA1 8280aafed0c612b6b707c43d0c2009d0e67517ba
- SHA512 afda44f5fa6c5596eee9f5e9fa3d58396b6d71edf247ad393a448e32746c76963c584a8bb27e181404871c97a55d535fa90f179c8116da2b419de880e77e4372
- SSDEEP 49152:P/a55ecI7V+dOAlmOA5MzXq5L9uiibpJKQZCbRquA/m2yL5zbfFiV+XenmE3/zb:Pk67S4giifQoq2Vjnmc
- TLSH T1B3668E05F7A481A4E4FB82B5C7BA8156F2767C504B3496DF02D486AE2F33AE15D3A313
- MD5 SHA1 SHA512 SSDEEP TLSH