Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 01:29
General
- Target 2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe
- Size 7.9MB
- Sample260910-bwanlsee63
- SHA256 86b91ab3e868bc4fad38270e64d521347b581e039bf528565fe6d61f52a0545c
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 1 IoCs
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
- Detects executables manipulated with Fody 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe" -restart2⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe.log
2026-09-08_f90917d7fe62c1cac9a83ebb0d071556_amadey_cobalt-strike_elex_glassworm_icedid_luca-stealer_.exe.config
RAMTheme.ini
log4.config
memory/1284-1-0x0000000005A40000-0x0000000005FE4000-memory.dmp
memory/1284-2-0x0000000005460000-0x0000000005470000-memory.dmp
memory/1284-3-0x00000000053D0000-0x0000000005416000-memory.dmp
memory/1284-4-0x0000000005530000-0x00000000055C2000-memory.dmp
memory/1284-5-0x0000000005490000-0x00000000054B6000-memory.dmp
memory/1284-6-0x00000000054C0000-0x00000000054DE000-memory.dmp
memory/1284-0-0x0000000000240000-0x0000000000A22000-memory.dmp
memory/1420-23-0x000000000C7C0000-0x000000000C7CA000-memory.dmp
memory/1420-34-0x000000000D060000-0x000000000D068000-memory.dmp
memory/1420-16-0x0000000006AB0000-0x0000000006B24000-memory.dmp
memory/1420-19-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-20-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-21-0x000000000C230000-0x000000000C264000-memory.dmp
memory/1420-22-0x000000000C730000-0x000000000C7C2000-memory.dmp
memory/1420-13-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-28-0x000000000CB40000-0x000000000CB98000-memory.dmp
memory/1420-30-0x000000000CBF0000-0x000000000CCA2000-memory.dmp
memory/1420-31-0x000000000CDF0000-0x000000000CE12000-memory.dmp
memory/1420-32-0x000000000CF60000-0x000000000D01E000-memory.dmp
memory/1420-33-0x000000000D020000-0x000000000D03A000-memory.dmp
memory/1420-17-0x00000000061F0000-0x00000000061FA000-memory.dmp
memory/1420-35-0x000000000D050000-0x000000000D058000-memory.dmp
memory/1420-36-0x000000000D0A0000-0x000000000D0AA000-memory.dmp
memory/1420-38-0x000000000CE40000-0x000000000CE52000-memory.dmp
memory/1420-119-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-209-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-210-0x0000000005B70000-0x0000000005B80000-memory.dmp
memory/1420-211-0x000000000D6E0000-0x000000000DC0C000-memory.dmp
memory/1420-212-0x0000000005F60000-0x0000000005F6A000-memory.dmp
memory/1420-213-0x0000000005FA0000-0x0000000005FB6000-memory.dmp
memory/1420-214-0x0000000006020000-0x0000000006028000-memory.dmp
memory/1420-215-0x0000000006030000-0x000000000603A000-memory.dmp
memory/1420-216-0x000000000D1B0000-0x000000000D504000-memory.dmp