Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 22:57
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 8.3MB
- Sample261002-2xcgpsvcqa
- SHA256 b930fba3f4d01b06367d9947d23cd71a1b3b2a17c63d9a7248758a5e9036bcbf
- MD5 ef5d248a49cedc8988ec3dd35cdada48
- SHA1 da028f82ad15ea49195258da4a94840410c99c01
- SHA512 b5ed4ff63ff9227c6339a1595c5e2498df45ce4b75606df851e2fca884b0502c9c7e12272b038b1018ec4d470523cf4a584e0ec3b15da382046617fcf53d5ffa
- SSDEEP 49152:kpEqJtb2I5RJ5T3S9tsgX8zEC8ULgCSA/Bkj0bgjI45TMwwapIgTMeW4SkZP4szX:kqiR3TIOSAzLapIXfkZcSTIOSAZ
- TLSH T1CA965C1272F44527E1AE923ECA714A3897B17C3A9FF2C78F7404B5DD1972782A526323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b223-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral2/files/0x000300000001b223-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\bthudtask.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\clip.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SndVol.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dccw.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\at.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\systray.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\makecab.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\relog.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\format.com- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1591_none_d92b9cc442553e63\lsass.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\wscript.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\r\ksetup.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_42528c82d31b82f1\cvtres.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\Taskmgr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_b667649ed5836b0d\aspnet_regiis.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopStickerEditorWin32Exe\DesktopStickerEditorWin32Exe.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\r\ChtIME.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.26100.1_none_17ee58fea8875a62\wmlaunch.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tionsnonwinpeplugin_31bf3856ad364e35_10.0.26100.1_none_a385593075152a7a\PnPUnattend.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\r\WaaSMedicAgent.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\wiawow64.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\r\wininit.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\mavinject.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\TextInputHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\show_third_party_software_licenses.bat- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\winload.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_237c8b12f2862d5e\format.com- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\r\PkgMgr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ARP.EXE- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.26100.1150_none_68a5bbed8a1f4ed6\r\uwfmgr.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.26100.1150_none_8e0a1d6fce8b1d12\adamsync.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\hh.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\r\Defrag.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\r\ielowutil.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\PktMon.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..al-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_cd32a881f6fe4738\ChtIME.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-pkcs11-helper.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_caaf3dbf28b048ab\choice.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\bfsvc.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_2f836f38379760e2\WWAHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_b800bbe6c459021b\csc.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\TextInputHost.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\r\Robocopy.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.26100.1_none_c6d712038d260ae7\SystemPropertiesDataExecutionPrevention.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\r\vssadmin.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\LogonWebHostProduct.exe- 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_ef5d248a49cedc8988ec3dd35cdada48_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.2MB
- SHA256 d9c1f1230d4398646845f4327e53580ecc988f54c54a19794f3d1184a01d6016
- MD5 67f49c34fedad70efd598b57816d2987
- SHA1 e91fe9ca944a0d5ffcb5da808b6da913925d1050
- SHA512 2e5cf29c557ad31f609e1ba5a43900bcdeb5946551304642a50a0c787bb3df332a299cb30e303bd58fb5090428d0c831b2f3ea3da108fd15099b51ae3bbc0805
- SSDEEP 98304:kqiR3TIOSAzLapIXfkZcSTIOSA2ezSC6v2XMHM:LitTf/cIvPSTfRz
- TLSH T1A0A65D1272F44627E0BA917EC6715A39A7B13C3A9BF2C78F7004B5DD19727C2A526323
- MD5 SHA1 SHA512 SSDEEP TLSH