Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 22:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 6.4MB
- Sample261002-2mn3raxvby
- SHA256 88eaf54ed69ad9dc4e7b0c35c9b962c1a9933f219d842b6514fe16a653c1b1b3
- MD5 f24d20a7b17b2f37719d7e9b28937ab6
- SHA1 71f1d4c6eb7dd9de96b762f0940344d6ebea8ded
- SHA512 e1217b1f8af4740dab04891969efd6e1e5eae50c78f8804d118473ba3ec0a0571f08cabe02f2da56c1618559696bde067672e3029319f576096ae04060066359
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgTMeW4SkZP4szj:kqiR3TIOSAzLapIXfkZcMD
- TLSH T1E8664C2272F44626D06A917ACAA15639E7B13C2A8BF1C7CB7104B6DD1E737C1B536323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral2/files/0x0008000000011392-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000f000000006aaa-1112.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/files/0x0008000000011392-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x000f000000006aaa-1112.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\auditpol.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\findstr.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\newdev.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\clip.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\runonce.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\svchost.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tar.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wscript.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\dotnet\dotnet.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.26100.1150_none_0bdb83c7d007c6bc\PresentationHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.26100.1_none_7765998af39f4114\cliconfg.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\iexpress.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\WSReset.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\UCConfigTask.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.26100.1_none_e49f43adae7337af\jsc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_89ffc359e797abf7\cvtres.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\wscript.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.26100.1_none_217b48412b560e3f\aspnet_wp.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_10.0.26100.1_none_38dc86afc79cd565\reg.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet_31bf3856ad364e35_10.0.26100.1150_none_f9988b77e1b9cb1d\vmplatformca.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1150_none_765afbb4c501d8c8\iscsicli.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\r\chkdsk.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\GenValObj.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\r\ThumbnailExtractionHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_d85b84d668a60dd1\r\IMEWDBLD.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.26100.1150_none_09f77181ae5e3bb1\deploymentcsphelper.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\LiveCaptions.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1150_none_9d9573a1c9f40852\r\dvdplay.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmbind.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\AtBroker.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_6afaa980b9711021\SystemPropertiesProtection.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adamuninstall.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\la57setup.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7161e3793d394d15\sc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_10.0.26100.1_none_007a743337203bf3\wmpnetwk.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\SnapLauncherProtocol.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\MiniSearchHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizard.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\ApplyTrustOffline.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\TRACERT.EXE- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Microsoft.AsyncTextService.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.26100.1_none_543fb8ac1ab3e68b\appidcertstorecheck.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\ScreenClippingHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmimport_31bf3856ad364e35_10.0.26100.1_none_22104f68acb76d7f\VMImport.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_421e63a4855b894f\resmon.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.712_none_685cc408c767126a\Windows.Media.BackgroundPlayback.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1_none_f6992c40f1427a7d\mobsync.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\r\Utilman.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\MicrosoftEdgeDevTools.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\r\WpcUapApp.exe- 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_f24d20a7b17b2f37719d7e9b28937ab6_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.3MB
- SHA256 57b51369a8b70edaafcf1807468e8a34828ce4d123c02dd65a547c8c10271ea9
- MD5 0ddd17c6cc64929467aa976fa6a89309
- SHA1 a33b99de641a7f27bbee3af53954fea1815e25ae
- SHA512 cb26a8ff88bd198a8c53fa09b8e4910c60ca26bfe461c5049d67f484207277de2e53a42fba7b4b7598677a96c39fd9cec1047a7398855c66a28263f8ddf990a5
- SSDEEP 98304:kqiR3TIOSAzLapIXfkZcM4ezSC6v2XMHz:LitTf/cIvPMvs
- TLSH T195765D22B2F44227D07AD17ACAA15669E7B13C2A8BF1C6CB3105B6DD1D737C1B536322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\JoinEdit.cmd-
- Size 6.8MB
- SHA256 0a7ee8d71577856d0c5f035f7f91295bc523233685bd52df5868495b12f8ac67
- MD5 7c5b60f32313c3947f5f80e657030bca
- SHA1 356105d14a05a65f4faf3aff0340c66066fbda3a
- SHA512 748ba1c199550fc88583d4827ebd83c47c41ede7f8d13aa1dbef7df8248eb1ac374bb3d562c0e3e03f3d94bf56e6864937f1393d09f12bf2fb52f0cdf7c1857d
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgTMeW4SkZP4szb:kqiR3TIOSAzLapIXfkZcMgtsoraqat
- TLSH T119765D2272F44626D06A917ACAA15639E7B13C2A8BF1C7CB7104B6DD1E737C1B536323
- MD5 SHA1 SHA512 SSDEEP TLSH