Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 22:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 7.4MB
- Sample260806-2cndgace64
- SHA256 6d87ad63c3449c74633c6dcaa664ab2b45a2a3c1c88b90bdf652a9680f86daad
- MD5 eef7d2bdc7e5fcfcca1b4db2c858a3d1
- SHA1 5187dffb2651ab90207d609dedcaf37d1c598aa4
- SHA512 2be21c349a102c4eef4112d5259f237f92ca372ee5fb249fc1571f18ce5caa0015f35c4b1681880a250c43fae09242de445de4eba3f5ee15fc045d7e2cafd074
- SSDEEP 49152:P/aZCzN7U5ta1Lw/aZCzN7U5ta1LXzXq5L9uiibpJKQOCbRquA/m2yL5zbfFiV+x:P215ta1k215ta1diifpoq2Vjnm5
- TLSH T152768E15E2940054EC6E4E74C6555135F2227C1B3FACB6CBCEE0B27E9B3B6E069B9213
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1968 2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_eef7d2bdc7e5fcfcca1b4db2c858a3d1_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 9.6MB
- SHA256 1d104127cb18a34053745fecf28d371de0a9db617c2124e4fa3a4f6263891512
- MD5 56f4ae6d7905d66524f8822445b5db07
- SHA1 899396a90557e1d08066021d56c3daa6dc4be36d
- SHA512 13d8c6061791c34b6a89ded6f9a996b18e2a9e74fe202070be7a7fad90a0b38b422f9787b9c8f289c5a7ed6453a5c4262554a9cb3d1fd5fa4c5501cc28b05594
- SSDEEP 98304:P215ta1k215ta1diifpoq2VjnmJoq2VjnmD:P215ta1k215ta1VpGnyGnU
- TLSH T101A6D415E29440A4D8AE8E74C7558135F2327C1A3FACB6DBCDE0B22E5F376E059B9213
- MD5 SHA1 SHA512 SSDEEP TLSH