Analysis
- max time kernel
149s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 22:57
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 8.3MB
- Sample261002-2xcgpsvcqa
- SHA256 b930fba3f4d01b06367d9947d23cd71a1b3b2a17c63d9a7248758a5e9036bcbf
- MD5 ef5d248a49cedc8988ec3dd35cdada48
- SHA1 da028f82ad15ea49195258da4a94840410c99c01
- SHA512 b5ed4ff63ff9227c6339a1595c5e2498df45ce4b75606df851e2fca884b0502c9c7e12272b038b1018ec4d470523cf4a584e0ec3b15da382046617fcf53d5ffa
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgTMeW4SkZP4szX:kqiR3TIOSAzLapIXfkZcSTIOSAZ
- TLSH T1CA965C1272F44527E1AE923ECA714A3897B17C3A9FF2C78F7404B5DD1972782A526323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0003000000022bdd-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0003000000022bdd-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dxdiag.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\more.com- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\find.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\winrs.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\regini.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\runas.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\certutil.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\printui.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\newdev.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\timeout.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\immersivetpmvscmgrsvr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.19041.1_none_de343fb4f9af2b0a\tasklist.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_c939d70420d81ce4\r\logagent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\ntoskrnl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\Robocopy.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_9e3e509d4c4881e1\MuiUnattend.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1_none_bf506ecc66a800df\TiWorker.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.1_none_cb8306be5498a914\imjpuexc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\r\wslhost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\wscadminui.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVShNotify.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.19041.985_none_c3639a9e3ab1a351\f\WindowsSandboxClient.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\f\PktMon.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.19041.1202_none_7f995fddf54c000c\f\SppExtComObj.Exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.1151_none_ec390bd802a1c630\r\SearchProtocolHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\wevtutil.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.19041.1_none_cdd05846922cdabb\msdtcvtr.bat- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\f\vmcompute.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\f\PrintIsolationHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.1_none_8df65f134a48195f\rundll32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.19041.1_none_4bf3621a8ebe2ee3\vbc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.19041.1_none_992adeb39ce930a0\PackagedCWALauncher.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\r\ImeBroker.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\f\WaaSMedicAgent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\r\unsecapp.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.19041.1_none_984b09657ea8db5a\rundll32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.1202_none_05cd606e025d0d96\TrustedInstaller.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\f\wbadmin.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\f\tpmvscmgrsvr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\f\wifitask.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\WerFault.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ystemassessmenttool_31bf3856ad364e35_10.0.19041.207_none_59ba79211607f58f\r\WinSAT.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\r\Spectrum.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_99d1a4d398ff69a3\esentutl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1202_none_a391067a6b9b433c\r\appidtel.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.1_none_c3249fe181844dfb\MsSpellCheckingHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\f\MusNotificationUx.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\GamePanel.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8bc62bc63a30d6fb\nslookup.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.1_none_bafc9f61651f37d2\SystemUWPLauncher.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\f\lpksetup.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.19041.746_none_8443a7febb9ab03d\r\consent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..essagingcoreservice_31bf3856ad364e35_10.0.19041.1_none_98fad53f878bc04c\mqbkup.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\f\autoconv.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_01dba454b887ba53\r\fltMC.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.19041.1081_none_7e66aef13d0cb227\r\ie4uinit.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_8ddc3834fb6f659f\iscsicpl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.19041.1_none_77b40a18a99e4f02\csc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\wlrmdr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.19041.1_none_82a6b3679b68b331\MSBuild.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 8.8MB
- SHA256 13ab624c782cd6e3e37a701f0667c1527efbf03dfa9e1444f2e40be6d0a3938f
- MD5 4247ae4aa4e56f99f3a7b48129417dce
- SHA1 325508711bf5b0dbe0ea1f86df9c55ca80401019
- SHA512 1bdf5aab59fbed092c2282318d7527f47c0805426ab8a8a98231fa045b548159ae35c216ee59a51a18bb2600fb1f20a6782ad3a677324472eab4f15f5a7e48ce
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgTMeW4SkZP4szY:kqiR3TIOSAzLapIXfkZcSTIOSANjo5
- TLSH T16D965C1272F44627E06A923ECA715A3997B17C3A9FF2C78F7004B5DD19727C2A526323
- MD5 SHA1 SHA512 SSDEEP TLSH