Analysis
- max time kernel
95s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/09/2026, 07:25
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 4.9MB
- Sample260913-h89f2agf28
- SHA256 1d5f3da632c445d373dbd3f23d5e1c396298d4a0d64dd57cfefd63ab3c1f5c71
- MD5 02ae3602ec07f0b33477502c51cf30b4
- SHA1 349e5fdd071479ca356af551db2541e694af4e5d
- SHA512 1f84838fa8c8f0854beef8e5b4a68d536f35b5b2b133197f021825ae4495294a83e3bbb4f466ff9720fa0acb57ca61abdc3196bc886c8fc839faae62c4367fc1
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rX:YqcxAO1rC12eQEfkZcnFrX
- TLSH T179364A15B2F88B62E0BB8179C5A29645EA337C514F3087CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2976-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001b7fd-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019995-567.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001999a-566.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019afd-651.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019baf-649.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019ca8-1282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000000079a-1886.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2976-2007-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/772-2026-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 772 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7z.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2976 2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe 772 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_02ae3602ec07f0b33477502c51cf30b4_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2976
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.9MB
- SHA256 1d5f3da632c445d373dbd3f23d5e1c396298d4a0d64dd57cfefd63ab3c1f5c71
- MD5 02ae3602ec07f0b33477502c51cf30b4
- SHA1 349e5fdd071479ca356af551db2541e694af4e5d
- SHA512 1f84838fa8c8f0854beef8e5b4a68d536f35b5b2b133197f021825ae4495294a83e3bbb4f466ff9720fa0acb57ca61abdc3196bc886c8fc839faae62c4367fc1
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rX:YqcxAO1rC12eQEfkZcnFrX
- TLSH T179364A15B2F88B62E0BB8179C5A29645EA337C514F3087CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$
- Size 5.4MB
- SHA256 1a9909764da4ba0974f81b82e709777811123f227daca50af804d62ca9387824
- MD5 94cf096f2ef4592f9b035b4aef1b3032
- SHA1 b80a065eee035175b3532d804689c6b769192113
- SHA512 412ec789eb9ffdf097c9bd1edc52134bcd8093bb1d1b5ff07604633affb0aac0d69e9645b8f92bead159c81aa5ab6223857646f5e0e938f861f96c25002ee0a9
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rimWD:YqcxAO1rC12eQEfkZcnFrimW
- TLSH T1F8465B15B2F88BA2E0BB8179C9A29645EA337C514F30C7CF12559A6D2E337D18D36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.5MB
- SHA256 23a580d7fa132d0c8b1b04625a61c81f4acde9b4cb51e063a9f0db2df3e4f8af
- MD5 75953f4db903f298fc114f7f3fe7c8f8
- SHA1 4a4086dda4bfcd44303f9516d47f119c8475bdd7
- SHA512 5ec556ade70afdc6d144776cc577d665f96b9a4ff471871046c08a9bb5848004963b3f8aeeab1e566d158aeae8efa020e9fcdafe69aab7b78421f232ec3db649
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rTPjy:YqcxAO1rC12eQEfkZcnFrLjo
- TLSH T14A463A15B6B88B62E0BBC179C5A29645EA333C424F3087CF12599B6D2E377D18936733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 5.0MB
- SHA256 ff3dbbf1c36be442d7c39f9cc1c24d001ca660512f785739856280e565dd4955
- MD5 fd0b459e79f514ba13868cbaac541f66
- SHA1 4de16cd5f2466e711dbf569eb9d73b46879cf2b2
- SHA512 3658348c8770da3a4600881c062475f12edadeeef34fbd4b9da5cd0db19f20d024e5bc09c873c875123c7e5ae71d69322dde26c0ef52b841653d4b5f678bea03
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rC:YqcxAO1rC12eQEfkZcnFrC
- TLSH T182364A15B2F88B62E0BB8179C5A29645EA337C514F30C7CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$
- Size 5.0MB
- SHA256 7a532b5953bca7a86eeb63ff36db523b7e7d483f04fb40d8366e3a289a0a7bad
- MD5 e96b3e8cf59ac90d9e9d17a09e12ba2f
- SHA1 7fb41720df8dbccd7a6f632d57e785ba1c8792a3
- SHA512 a5a812e831eb13d04fcbd0ab602d90c63d731332a672a6a675e3c53f4d6b28f2fd742eed868fac900a49878e9c2be0f39e8834444e93c1cfb461418ab3cfd636
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rj:YqcxAO1rC12eQEfkZcnFrj
- TLSH T1B7364A15B6F88B62E0BB8179C5A29645EA333C514F30C7CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 5.0MB
- SHA256 f2d09e4f8998575224ba840cdb1a68fda9ca188d6a4335cb01a3fa512573b3e4
- MD5 d85cce4aa3529141845b250fa5bdc89c
- SHA1 bc65a262aa4aca641b4e2df9ad92231a943ba6d8
- SHA512 e4d12377577b7cde94f87cf08d5050fa0bee8a9167af230c63dd7fe8baa260a3d4a5a698bd10701a44d6ea1de5817ce20c98aeeca9aa440299b7de5ac4ca5ca7
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rD:YqcxAO1rC12eQEfkZcnFrD
- TLSH T1A7364A15B6F88B62E0BB8179C5A29645EA333C514F30C7CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 5.0MB
- SHA256 51cd1be9df2a61edc359ce8fdafa87d283c170cbadd49febeeada49dba38eda4
- MD5 e137f69d8606b6fc16db2f1165dc20a6
- SHA1 1df262746c8eec8743570aa0defd847049572d8c
- SHA512 1be00a178082cb4d5197869e0937237779edea9cd5b8580dd555c46e13bb39a0fa65070753eb2fc25e4b8b89edeb3a74c25253ac3f43c454332baae10414adb1
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56rA:YqcxAO1rC12eQEfkZcnFrA
- TLSH T1E5364A15B2F88B62E0BB8179C5A29645EA337C514F30C7CF12599A6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 5.0MB
- SHA256 534b1663c268fd0c95ca87ab66e9faf12e1f1b7fcb808149b3133d9052e17356
- MD5 36976f71a23b1b9f68e4c79a78fda269
- SHA1 15f45a948c2df0d46215b67911effdc52af47a53
- SHA512 9b9c822a4e60f6f51475cbee350a9927667de36afd1bc70d81e8333afc0eb8681416b3a72bbb464c972d95d6ae0abfb32518259d976cae50a99aa8e0dc1fe741
- SSDEEP 49152:BCL2c8MNFLA0vb7w56rawq3qJtb2IsgA2eQJ2eW4SkZP4sz9Mb9UOlk0I56r9:YqcxAO1rC12eQEfkZcnFr9
- TLSH T101364B15B2F84B62E0BB8179C9A29645EA337C514F3087CF1255AB6D2E337D18D36B23
- MD5 SHA1 SHA512 SSDEEP TLSH