Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 17:09
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 17.5MB
- Sample260808-vpl8lsvxfs
- SHA256 659c2f16e926d5166432457e92aebff36276e2a820942da32acf03e26cf61ff2
- MD5 dee53bfd91f29d9e55294b3b53f05f08
- SHA1 60e2d06b5df3b4da1d5c4efe7a165997e180d50f
- SHA512 f3b2ded210ffc81cb0d0206071c3146a018132f061d92786e268f05ab2f9f89c46f8bf150a524eedf07f7b09ad274f88ce67dde22f1f55cfd25599b9085cf72a
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2b88:8M9sqLVuIbUwF1VERmj2bD
- TLSH T1E207BE23B2E10566D16AD139CF618635D7B13C2A8BF1C2EB3144B6D92E737C17A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x001c000000024309-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x001c000000024309-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wextract.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\logagent.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\find.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\secinit.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\more.com- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\diskpart.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_10.0.19041.746_none_cc5cbb9556301da3\r\WMPDMC.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.153_none_70cb6ca43c818606\cmimageworker.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.746_none_e7acb2599054dc72\WSCollect.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\SysResetErr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_f68db62a3702882b\SearchIndexer.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\ResetEngine.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\r\rdpsign.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WMIADAP.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\r\Robocopy.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\Robocopy.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.1_none_c513167c1d0a90dd\icsunattend.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\relog.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.19041.1_none_13f5052244ba101f\WallpaperHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\r\icsunattend.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_4d40b8e902f83dd6\gpscript.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\setup16.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsacls_31bf3856ad364e35_10.0.19041.1_none_a2eda420e70d2fc8\dsacls.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-isoburn_31bf3856ad364e35_10.0.19041.1_none_4005191f803b56e1\isoburn.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\r\SecureAssessmentBrowser.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..pdate-oob-component_31bf3856ad364e35_10.0.19041.84_none_e539abe3d27f675f\r\rdvgm.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.1_none_41668bdd85c44640\InetMgr6.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\f\OpenWith.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisreset.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\f\wmlaunch.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.19041.1_none_81400e8a2cfebcbb\FirstLogonAnim.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.19041.84_none_d062347205e52d46\r\PerceptionSimulationService.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.19041.1202_none_4f22e21b58d6c2e3\r\BitLockerDeviceEncryption.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.19041.1_none_6db5d09458d426f5\wmpnscfg.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\conhost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.746_none_c1db40c45e8f2d9e\r\wbengine.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_b1e0044e8cab889e\setupugc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.19041.1_none_69775cdd639910cb\PING.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_b36547673f7cb25f\USRLOGON.CMD- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\f\ByteCodeGenerator.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\f\msoobe.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.19041.1_none_5668834b68c7e852\driverquery.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\f\PrintIsolationHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\SystemPropertiesRemote.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.746_none_52411fe22e5a0ca1\TapiUnattend.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.746_none_7946fb11bf19dc87\coredpussvr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\f\wecutil.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\r\prevhost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_0c4e6556fb852148\srdelayed.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.19041.1_none_345cbd92bc885eba\curl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\f\vmcompute.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\lpksetup.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\sxstrace.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_8bd71d601a2cdd3f\TSTheme.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\r\Win32WebViewHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\WmiApSrv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\f\SecurityHealthService.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.1_none_ef230558c150a821\inetinfo.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 18.0MB
- SHA256 7a8e3032e251768aea4119017fb2534d17dd9e24000513a3ed601d22f2ed5b38
- MD5 64993512803111e03543bf7a870c3072
- SHA1 10e82cf72dfa727946760cbc6c2e50e95cfcf6a9
- SHA512 9feb21b06080c44fc5f233907b8af95738b77f1e84eb895e63d17de74b35917b9da2d0ccbdea6d00f1d89998c19101633b5e8a4d4b7cecf0079683772430e7f3
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2b82oh:8M9sqLVuIbUwF1VERmj2bQh
- TLSH T15917BF23B2E00566D16AD139CF628635D7B13C6A8BF1C2DB3144B6D92E737C17A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH