Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 00:38
Behavioral task
behavioral1
Sample
2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
- Size 17.0MB
- Sample260808-ay9p2swflg
- SHA256 039b45880185b5c2f7d9fe76eb1a2f83f7896f3f38d83cd95c143d2765b32d6d
- MD5 d0acb0174fa383e754e109ea6f72c8e4
- SHA1 dac6f835b89ff57416e327e541e2b8633d0d73e0
- SHA512 ad385b5a304d2a70a4ac4e9aed098e6bbd1f1e59ab2006581873a63e2d89e0b386424ccb8212e97ad7e7297e8b0b9ec5134677157d5ce63631dd82ff71beed8b
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTfC6F:ERXMo5zqWYdyZ/K0ttYZTU9F
- TLSH T1FB075903F293849AE0A6D138C921863197313F6D87B395EF795872D8EA376D33639B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x001b00000001c511-5.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x001b00000001c511-5.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\help.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fc.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5908-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001b00000001c511-5.dat upx behavioral2/memory/5908-287-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5908-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7z.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateConfigItemGenerator.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.26100.1_none_5301f4e1e5797d14\XamlViewer_v0300.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_5fbacf2ef4cdcd88\expand.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-netfxsbs10_exe_31bf3856ad364e35_10.0.26100.1_none_dc63fc515e239427\NETFXSBS10.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\r\GameInputSvc.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpksetup.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ROUTE.EXE- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\Utilman.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\wbengine.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseCE.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\CHXSmartScreen.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\SensorRuntimeBroker.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.26100.1_none_ed0315824c80c112\fveprompt.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.26100.1150_none_d519484bd1dd0a29\inetinfo.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\msconfig.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-flexible-platform_31bf3856ad364e35_10.0.26100.1591_none_dd61c19e2e413ac5\fclip.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingShell.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\upnpcont.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.26100.1_none_bdae08941820f568\waitfor.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.26100.1150_none_eb28a122b02acd12\ldp.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\r\DsmUserTask.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\LockAppHost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\logagent.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.26100.1_none_6c5f8b350c999f6d\gpscript.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1150_none_7de38ebb78ccb039\r\tcmsetup.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1150_none_f9eb481555467227\WallpaperHost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\phoneactivate.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\bcdedit.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.26100.1150_none_f9eb481555467227\r\WallpaperHost.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_77e8b53c81b6cf4f\userinit.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\SpatialAudioLicenseSrv.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpconfig.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\r\sdchange.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgusr.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\r\UserAccountControlSettings.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.15912.0_none_53903386cd9b843e\cvtres.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_09f5b9f9e6fe0f73\hvsiproxyapp.exe- 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_d0acb0174fa383e754e109ea6f72c8e4_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 18.0MB
- SHA256 1f9d84c0dcca3156f94128b8ccfb1ac3665d9f04000ef535ee67a20c8e523b4d
- MD5 afdf765a05c8420ed6e468475f4cb4b0
- SHA1 c9511593abb0e128783467955fee9150f544d3d6
- SHA512 cbcc3b661cde31cfb03ae3954b26d237485af7a51c05242d79129393837477c4b52b951cdc064d3f5fb6686036feb7a6d790d305dce8ed2eac4c969c6f3fbfae
- SSDEEP 196608:ZaHxXMZ6+oEKmd00dFdUDX56CWyZ/K0ttYVAATYTfC6Ry:ERXMo5zqWYdyZ/K0ttYZTU9k
- TLSH T129175903F2A785AAE0A6D138C961863197313F6947B381EF7508B2D8EE376D37639711
- MD5 SHA1 SHA512 SSDEEP TLSH