Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 23:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
- Size 9.3MB
- Sample260806-2243hssemg
- SHA256 a8b4996268565a2c7013e4ebe04bb5c57dc9fa954e2453d7a4d0957bcb37e563
- MD5 6487550b6bbb2b48565fc7f6cf4cf608
- SHA1 716b3a4511f42f163aa1602d3e01306419685883
- SHA512 565573ee0c8e073679aade225c2d94214c033bf77040b132054575e1572ba78e2c42e1eb5d93934053e5792b49b620e5e5dd7ceabfcc24a4b73070d4b4de8315
- SSDEEP 196608:Ca1v3xzpAa0f7GCoa1v3xzpAa0f7GCYGnq:Cav3xzEf7GTav3xzEf7G7Gq
- TLSH T18CA64A06E69441E8D0AEC174C7568622F6737C550BB0A6DF06E0F67E2F33AE05AB9713
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5400 2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_6487550b6bbb2b48565fc7f6cf4cf608_cobalt-strike_elex_glassworm_hijackloader_icedid_luca-st.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 11.4MB
- SHA256 bb5cc469fb7986b27272ba8f3f48b9ce25daf884f1b2d047f7d92faf6f55dd83
- MD5 080bd0878386b427e665e7b0487ed25f
- SHA1 83383e8818fadfe7ef068df4924567160764592e
- SHA512 093b7d6c96d446c32ea4ab9394b8695a318c43407964fc7265ba3865210bb7006d817da381c368e933a390727c33d62beac6293882de92590cebb85481d67402
- SSDEEP 196608:Ca1v3xzpAa0f7GCoa1v3xzpAa0f7GCYGnSGni:Cav3xzEf7GTav3xzEf7G7GSGi
- TLSH T153C64B06E6A841E4D0AEC274C7568612F6737C154BB0A6DF06E1F67E2F33AD05AB9313
- MD5 SHA1 SHA512 SSDEEP TLSH