Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/10/2026, 16:23
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
- Size 4.8MB
- Sample261003-tv3bcasdmc
- SHA256 6a409befc21696446e124fbed2e49812550f04d2fb99df02eacd8a5a3417b533
- MD5 1d401a1fc307c316fdad39364a8cf98c
- SHA1 8a228a1aade6594a6f6d94ec3fe2ca8f91421b05
- SHA512 f25555011df7fd0d343b1ffcebc836e3ff22d9c427d023220f7317c2dd9490273fb24a11c751c45cb91f16f9f88eb98092750ed925c2bd4baeb8996e90973c8c
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbvT3S9tsgX8zEC8ULgCSA/Bkj0bVBXdcnPji0Aj6:7fkZcvTIOSABd0jou
- TLSH T125367C16B3F84637E0BB927EC0B15A7DE771742A9B32C68F3104AA5D1D677828527323
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 1 IoCs
resource yara_rule behavioral1/files/0x0005000000022bf2-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
resource yara_rule behavioral1/files/0x0005000000022bf2-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WWAHost.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\net.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\raserver.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\charmap.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\finger.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\hh.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\psr.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\printui.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\comp.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\runas.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\clip.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\relog.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\replace.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\where.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\format.com 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\sfc.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\7-Zip\7zG.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.264_none_2f9647f4d89dc6f5\r\explorer.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.153_none_c8fbed52dad932cb\ResetEngine.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\sessionmsg.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft.workflow.compiler_31bf3856ad364e35_4.0.15805.0_none_eb7ee992c51a9917\Microsoft.Workflow.Compiler.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.19041.1_none_16cc981df6cf3111\WmsUserAgent.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_e6d5f08988c6cb95\DWWIN.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_d6be4622df33d026\edpnotify.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\f\explorer.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\f\wmprph.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.19041.1266_none_92496ac84272f5f1\f\LegacyNetUXHost.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.19041.1288_none_64cb20c6329bf2bd\f\ntprint.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\r\wscript.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\PasswordOnWakeSettingFlyout.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.1_none_6b761570d2ba1947\certutil.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.19041.1_none_60ade0eff94c37fc\osk.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\r\WpcUapApp.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\r\SrTasks.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1_none_ef1691668a233417\appidtel.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.1_none_24a9c1e1e1b0f793\tttracer.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.1_none_c8deb9da2cb2458a\rrinstaller.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\f\XblGameSaveTask.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\f\setup16.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\setupugc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\r\auditpol.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.746_none_7c508e4438cec899\f\LicensingUI.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.19041.1_none_3e188ad1a12f1c4d\dpapimig.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.1_none_b4746d3aaf96ef0d\regedt32.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\agentactivationruntimestarter.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\fc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_3e7b05a1a0865eeb\ktmutil.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdge.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_833d086e8f306c45\dfsvc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15805.0_none_c0d2d1227427864f\dfsvc.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\f\Microsoft.AsyncTextService.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1202_none_cc0c3d35675da3a1\f\appidcertstorecheck.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.19041.1_none_e6307765e4f96817\msfeedssync.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.19041.1_none_846d8bda2133af3c\whoami.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_1befc89391e44c23\autoconv.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.19041.1_none_23f80ea3f041fc17\SystemPropertiesProtection.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_da90d957e87f3409\ImagingDevices.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.546_none_f57e58b71b913c6b\f\auditpol.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..client-ui-wscollect_31bf3856ad364e35_10.0.19041.1_none_bfa47510d0e31e28\WSCollect.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_multimedia-rrinstaller_31bf3856ad364e35_10.0.19041.746_none_fb3ba1752084c5cf\f\rrinstaller.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\MRINFO.EXE- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\f\runexehelper.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15805.0_none_b2fd45ddd475eb50\ngen.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_198d8d483aa30ed0\gpresult.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.19041.1_none_d7cac98c90803a6a\auditpol.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1023_none_6aeab5d4bd0371a8\r\instnm.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_4.0.15805.0_none_faee98a3c711fae7\AddInProcess32.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_7777dd52093f9dd6\f\control.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\f\CameraBarcodeScannerPreview.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.1_none_fa9e6f40748daf14\colorcpl.exe- 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-02_1d401a1fc307c316fdad39364a8cf98c_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1612
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 5.3MB
- SHA256 5c385ecac421f550f6cc21372bd24fa8c245179d2448d10f2ba2c2b23c7f8275
- MD5 81a60c86db4a89df6aa76841a7feb54b
- SHA1 26b91266fbdb32f454c74e9b4ddc6bfc8cc2269f
- SHA512 d7ef3a692d8e8d53479d21f805b0f8d93f13d14c68cb1bff9cbb05ab18faa133287c0cdfbad400d84da7bb08e99b647a47889cc017212b87b80fc560594a4621
- SSDEEP 49152:Dx4fD2eW4SkZP4sz9MbvT3S9tsgX8zEC8ULgCSA/Bkj0bVBXdcnPji0AjYPji0AZ:7fkZcvTIOSABd0joijoZ
- TLSH T1FB466C16B2F84737E07B927EC0B15A6DEB71342A9B32C68F2144A66D1D677828537333
- MD5 SHA1 SHA512 SSDEEP TLSH