Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 3.1MB
- Sample260819-e7jx7syvdw
- SHA256 c61fd5566ba2208046b10cd9694556327bca2943c3e72d97b60e22e410a5dac5
- MD5 b9c8686bab610185568656d16d8164b3
- SHA1 fcbe2fbaa4359138ca59abeb0d49cf229c81968a
- SHA512 4f1862df90299e129dd234a978bfa0e43c8cbfceafc9232dfdea4d137ea3219ce2b44208cf951f3bd7a3bb9897f1fbfe4d6635ec0f5be702887121482603f301
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYqHVBXdcCZQZClVBXdcc:7fkZcX6Wdfdf
- TLSH T16EE55C15F6788276D0B3D079C6D7AA56FE3234460B309ACF038993682F277E19A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\setx.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\InstallApprove.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.26100.1_none_e49f43adae7337af\jsc.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_c5344c677bcead1d\TsWpfWrp.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\winhlp32.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.26100.1591_none_72c54a0c20f4219b\AxInstUI.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_vmconnect_31bf3856ad364e35_10.0.26100.1591_none_2bf6278ffa2525b6\r\vmconnect.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\r\AggregatorHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\r\msinfo32.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\charmap.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\aspnetca.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\lodctr.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\omadmclient.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\r\DevicePairingWizard.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\r\EASPolicyManagerBrokerHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\plasrv.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuauclt.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\dwm.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telnet-client_31bf3856ad364e35_10.0.26100.1150_none_5418e1dbd4f45309\r\telnet.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\resmon.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-pkcs11-helper.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.26100.1_none_7e03589d55737e66\AddInProcess32.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.26100.1591_none_b89e4fe4764210cb\r\SIHClient.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\fixmapi.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\Utilman.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\r\rdpinput.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-voiceaccessstub_31bf3856ad364e35_10.0.26100.1591_none_129ee3df08a8deda\VoiceAccess.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\powershell_ise.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\stordiag.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.26100.1591_none_d13ec0589abf0359\directxdatabaseupdater.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adaminstall.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.26100.1591_none_e5de07285a53f2d6\spaceman.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_9e69ab15e1442616\Utilman.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.26100.1591_none_efe288270f8c9b0b\r\pacjsworker.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\FilePicker.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.26100.1591_none_052b2ae1ad719889\r\FileExplorer.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\r\CustomShellHost.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrs.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\r\ClipUp.exe- 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b9c8686bab610185568656d16d8164b3_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4520
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.0MB
- SHA256 6175e66ee5cff9c9aa71cb1e7b471756e7e9df997f701c9995752d6d34a60a00
- MD5 abcb6d99529efe8e5ad5847d1cfe3d6b
- SHA1 51cfce658b033c7afadff45fbdc6d0976d188aac
- SHA512 f7237508cec13eb3eb83e13768bdd8de966af3f68168ea0a05a74c30d0dbaae20d56e6175a6c9576783f3089bbe270ea9c864963b520a761314d5c5433bfdb5a
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbiYpYqHVBXdcCZQZClVBXdct/ezSC6vUzPvMHjy6:7fkZcX6WdfdcezSC6v2XMHL
- TLSH T192164A15F6788376D0B3D0B9C5D7AA5AFE3234460B308ACB0349936C2E277E59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH