Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 17:09
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 17.5MB
- Sample260808-vpl8lsvxfs
- SHA256 659c2f16e926d5166432457e92aebff36276e2a820942da32acf03e26cf61ff2
- MD5 dee53bfd91f29d9e55294b3b53f05f08
- SHA1 60e2d06b5df3b4da1d5c4efe7a165997e180d50f
- SHA512 f3b2ded210ffc81cb0d0206071c3146a018132f061d92786e268f05ab2f9f89c46f8bf150a524eedf07f7b09ad274f88ce67dde22f1f55cfd25599b9085cf72a
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2b88:8M9sqLVuIbUwF1VERmj2bD
- TLSH T1E207BE23B2E10566D16AD139CF618635D7B13C2A8BF1C2EB3144B6D92E737C17A3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c4be-4.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000f00000001c4be-4.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\efsui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\convert.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\netsh.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\taskhostw.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCLNWZ.EXE- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-isoburn_31bf3856ad364e35_10.0.26100.1_none_e3264f8001c7dc21\isoburn.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\r\net1.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\r\SndVol.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_705e51669f200004\powershell.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_e81c261923f0a4b6\r\ntkrla57.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-vaultcmd_31bf3856ad364e35_10.0.26100.1_none_e3755908c2899c00\VaultCmd.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1150_none_05da7b3a4b13ee64\TapiUnattend.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\r\ThumbnailExtractionHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_8633c2a132a5236f\aspnet_regbrowsers.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..microsoftedgebchost_31bf3856ad364e35_10.0.26100.1150_none_faa81bed523ab303\r\MicrosoftEdgeBCHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\doskey.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\r\ieUnatt.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\r\desktopimgdownldr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\StartMenuExperienceHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_b9d66d642921dc90\attrib.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1_none_bd03ac53a23b1a65\svchost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\r\nbtstat.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_824861107299001b\imecfmui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\Defrag.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\r\rdrleakdiag.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\EaseOfAccessDialog.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\quser.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\runexehelper.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmproxyd.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1150_none_56532b8e4ca54ecd\r\verifiergui.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpresult.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\r\GameBarPresenceWriter.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.26100.1_none_012c60dec828ce67\ssText3d.scr- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\FESearchHost.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.26100.1_none_5d765ef408ee3573\tar.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\CloudNotifications.exe- 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_dee53bfd91f29d9e55294b3b53f05f08_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 18.4MB
- SHA256 5636649d28d75e6ea194eda1b565a54be16b5bf4c5f2c9408fde90a34293ae2c
- MD5 c67712317aab8999075acb12ca5e9cec
- SHA1 5c5e811079296f351d75a9d94bb0223a67ad4103
- SHA512 5b57915866ca111d1c3d25dfe379dd2ab4f5b828054df55b25a6d260b588c49ad53337cb1c1ab3cbc047a5d3e6fef6a00c46b3c8499b65e2ab5a92f6586afa0a
- SSDEEP 196608:LitTf/cIBoEFdYKmd0RoocIWdyeGZF6bUpMBF1p/kjRm4OWi2b8yn:8M9sqLVuIbUwF1VERmj2b/
- TLSH T1D117BF22B2F44566D06AD039CF928635D7B13C698BF1C2DB3144B6D92E737C17A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH