Analysis
- max time kernel
84s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/09/2026, 07:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 4.9MB
- Sample260913-h89f2agf28
- SHA256 1d5f3da632c445d373dbd3f23d5e1c396298d4a0d64dd57cfefd63ab3c1f5c71
- MD5 02ae3602ec07f0b33477502c51cf30b4
- SHA1 349e5fdd071479ca356af551db2541e694af4e5d
- SHA512 1f84838fa8c8f0854beef8e5b4a68d536f35b5b2b133197f021825ae4495294a83e3bbb4f466ff9720fa0acb57ca61abdc3196bc886c8fc839faae62c4367fc1
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rX:YqcxAO1rC12eQEfkZcnFrX
- TLSH T179364A15B2F88B62E0BB8179C5A29645EA337C514F3087CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral1/memory/3728-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024435-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000022bba-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001fcda-123.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002255f-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000202e2-1364.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3728-1383-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4756-1402-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0015000000020276-1518.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4756 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3728 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 4756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3728
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 1d5f3da632c445d373dbd3f23d5e1c396298d4a0d64dd57cfefd63ab3c1f5c71
- MD5 02ae3602ec07f0b33477502c51cf30b4
- SHA1 349e5fdd071479ca356af551db2541e694af4e5d
- SHA512 1f84838fa8c8f0854beef8e5b4a68d536f35b5b2b133197f021825ae4495294a83e3bbb4f466ff9720fa0acb57ca61abdc3196bc886c8fc839faae62c4367fc1
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rX:YqcxAO1rC12eQEfkZcnFrX
- TLSH T179364A15B2F88B62E0BB8179C5A29645EA337C514F3087CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 5.2MB
- SHA256 4409abc784283c99ca8401c9895db183ebc4842949ee5404d71c23cf4b67612a
- MD5 76473d08986b22688609abfcbadf3676
- SHA1 b9afb6ebd4d41bf3c796bfddc780439ef5fab943
- SHA512 427930afd284b9138ab72dc5499ec4b1afc6863c702629671a431c371e3204d35e71ef0e15fdb895cb7e55311f0be14c849776a7a95fb4262068a3fcc3af94c8
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rtUNw:YqcxAO1rC12eQEfkZcnFrHE
- TLSH T198464A15B6B88FA2E0BB9179C9A29645EA337C510F30C7CF12559B2D2E336D18D36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.4MB
- SHA256 bde76d0d6447d058a1f7b1e6c4b9dbe7b5139371aba31180d8b415aa802780cb
- MD5 06ccf9d14f10ca0696219cd440142f24
- SHA1 5aa31bc729b81366050d252f54b400860737ef16
- SHA512 392598397e3f0ed99deef686798b90778baba5f394bcb9a0f52f1268912de70a7f499b6bb8ae88589a51b2fe3b4912619595c3ee748efa6ef49c44d11336809c
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rXTdi:YqcxAO1rC12eQEfkZcnFrTCqo
- TLSH T1A1465B55B2F84BA2E0BB8179C9A29645EA333C514F30C7CF12559A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.5MB
- SHA256 23a580d7fa132d0c8b1b04625a61c81f4acde9b4cb51e063a9f0db2df3e4f8af
- MD5 75953f4db903f298fc114f7f3fe7c8f8
- SHA1 4a4086dda4bfcd44303f9516d47f119c8475bdd7
- SHA512 5ec556ade70afdc6d144776cc577d665f96b9a4ff471871046c08a9bb5848004963b3f8aeeab1e566d158aeae8efa020e9fcdafe69aab7b78421f232ec3db649
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rTPjy:YqcxAO1rC12eQEfkZcnFrLjo
- TLSH T14A463A15B6B88B62E0BBC179C5A29645EA333C424F3087CF12599B6D2E377D18936733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 5.1MB
- SHA256 b0dc8ba24fb5717b123d24e01ca33982872a68f74bb2675ab57306a3d17c905b
- MD5 aa5484becc72a014734eea094a6ffe21
- SHA1 a9821857de719238900e51a9a51e069d0ee6f702
- SHA512 4f0faf3fbc1376f1031b6a797987c8384e617bf2207ac39d20b2123ac743a6dc1d7e9183aa07f6c747f63e696fc81f9a95cf1478b5d99fe49f0a093d022334de
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rU:YqcxAO1rC12eQEfkZcnFrU
- TLSH T13E363915F2B84BA2E0BB9179C6A29645FA333C514F3087CF12859A6D2F336D18D76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe
- Size 5.0MB
- SHA256 534b1663c268fd0c95ca87ab66e9faf12e1f1b7fcb808149b3133d9052e17356
- MD5 36976f71a23b1b9f68e4c79a78fda269
- SHA1 15f45a948c2df0d46215b67911effdc52af47a53
- SHA512 9b9c822a4e60f6f51475cbee350a9927667de36afd1bc70d81e8333afc0eb8681416b3a72bbb464c972d95d6ae0abfb32518259d976cae50a99aa8e0dc1fe741
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56r9:YqcxAO1rC12eQEfkZcnFr9
- TLSH T101364B15B2F84B62E0BB8179C9A29645EA337C514F3087CF1255AB6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH