Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 18:00
Behavioral task
behavioral1
Sample
2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 9.9MB
- Sample260808-wlgpdswvcv
- SHA256 d852fa686b8bf86da7038d602a799486f199767a8084eda420436bbf11de208d
- MD5 40cf61c3a12268151f9f7b8611e40ef5
- SHA1 496a7e65dfb88eaf6bd0545068b0b715c82fa85e
- SHA512 4323a32f1bf28c15264a5f82814a03bfc1ef281fea5f53e02252e6c99f872ac04a143848e7dab3fee67804563c92cdbb23789ec43519ab6f62c19a270bb20ca9
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcf2/PvOAjcXvvOOc56:ZaHxXMZ6466HtItoOHOAoXvvOi
- TLSH T19CA62C4AF213945ED246D5348509C932E6307B6C87B35DBFB85CF3A8EE3B5632939A10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral2/memory/3304-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c4ba-5.dat upx behavioral2/memory/3304-451-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3304-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\r\fsutil.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.26100.1_none_dd9c925292d9a76c\printui.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.26100.1_none_0a1c6a6364e5546e\shutdown.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFHost.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\netcfg.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\rmttpmvscmgrsvr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.26100.1591_none_f78199e24ed908bc\slui.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_fe90da8a8133c864\SystemPropertiesAdvanced.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttune_31bf3856ad364e35_10.0.26100.1_none_baccdf245b7274cb\cttune.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\r\w32tm.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_e93c3ffc5eae7f6f\autochk.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\dmcertinst.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\InputSwitchToastHandler.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nbtstat_31bf3856ad364e35_10.0.26100.1150_none_39f7d4e8ce48dadd\r\nbtstat.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.26100.1591_none_e6af58ceedab4a7b\WpcMon.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\r\InetMgr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\provlaunch.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgrsvr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\tttracer.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-userinit_31bf3856ad364e35_10.0.26100.1591_none_823d5f8eb617914a\userinit.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.26100.1150_none_6adbcfcc35357e97\wiaacmgr.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiWorker.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.26100.1_none_b345269d05057414\winver.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1_none_50f771e4b4a3c0ee\win32calc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\r\Eap3Host.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\r\esentutl.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\securekernella57.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVStreamingUX.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\Defrag.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\r\Robocopy.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-systray_31bf3856ad364e35_10.0.26100.1_none_fa99cf8592f76fdd\systray.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\Windows.Media.BackgroundPlayback.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\phoneactivate.exe- 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_40cf61c3a12268151f9f7b8611e40ef5_akira_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3304
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.8MB
- SHA256 e969cb76ac6d4a56e3c43a4b3ff84366a071ef92b6cd054de2d1b64119d1bca2
- MD5 3bbdd7e60eccb55b4c984ede52ccbe23
- SHA1 58ce3eb5e8c3bc89932832e5c7a32ecafbafd4b8
- SHA512 f58ec09ca9de98b82bd347c742b96d7d3bcc7d12f398ad54e9b56c7dba627983cf5857ef94ffc8f03f4f278de324a08b745f5d91dc5cc3a75c6aded7f7882fce
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcf2/PvOAjcXvvOOc5bezSC6v2XMH1:ZaHxXMZ6466HtItoOHOAoXvvOAS
- TLSH T10DB63B4AF223945EC256C5348449C932E6303B5987734DBFB95CF3A8EE3B5A36939B10
- MD5 SHA1 SHA512 SSDEEP TLSH