Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/10/2026, 20:15
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 6.7MB
- Sample261015-y1tzdaeb24
- SHA256 84c223503c4d23efe77248eabb64afd7b0fb3fcd18167134657af65a81f8d09b
- MD5 08950b2af48c1aa1aa7a4890eaefab88
- SHA1 3c9882abf4511753a11db7be307a59881874c9e3
- SHA512 5a20b13037e3c3f1d31b0cbd969197d97d1ff7779cd566a0485a1360e0b1ce46455570c4da562b8cda405989d45f8142c009d1fab38ab81ea128ae58a7e73fec
- SSDEEP 49152:kdJDp5AVBXdct+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWT3S9tsgXp:kTzodN0oAaldmdmnpWTIOSAW6w
- TLSH T18B667C03B2E405A6E06AD23DC972453997717C2E8BF2D2DF3144B9DA2D72BC17A36712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 2 IoCs
resource yara_rule behavioral2/files/0x000a000000019cb3-3.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000f000000006ab0-1110.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/files/0x000a000000019cb3-3.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x000f000000006ab0-1110.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutil.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Fondue.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\calc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\autofstx.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\certutil.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runas.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmc.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\print.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.26100.1_none_21e4bd199d160d30\AddInProcess32.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.26100.1591_none_805965242ec082f4\LsaIso.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\vssadmin.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_3b8c278ba0146cc8\tzutil.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\mmc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\r\ImeBroker.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\IMJPSET.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1150_none_5dcdaa573c9a6613\r\chkdsk.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.26100.1591_none_763a39aa4dc6e7d5\r\msconfig.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.26100.1_none_cc7ea73da7f4750d\snmptrap.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_f9312521dc249ba4\WFServicesReg.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\FaceFodUninstaller.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\NetCfgNotifyObjectHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPUEX.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\explorer.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.26100.1_none_4b95a6089b289b29\Microsoft.AsyncTextService.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\WindowsActionDialog.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\LaunchWinApp.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\r\dxdiag.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\r\certreq.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\r\printfilterpipelinesvc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_554fc0a594820cda\WFServicesReg.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingShell.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4uinit.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\sftp.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.26100.1591_none_feafa9b0555ef776\agentactivationruntimestarter.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevTemplateConfigItemGenerator.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\r\spoolsvworker.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.26100.1591_none_85f1fbdaacd275e0\SystemSettingsBroker.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_d5c4d1091ec38541\whoami.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\r\CredDialogHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\r\UserAccountControlSettings.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.26100.1_none_9d6b1e2831f6fc5c\driverquery.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\appcmd.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-13_08950b2af48c1aa1aa7a4890eaefab88_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.6MB
- SHA256 b1d5d5b49fdb2ad337f656c025d2c985afd93c3f441255f8b769dd203dd3a741
- MD5 7a6a8b96c86dcb8441d548522f407939
- SHA1 1218c38d09c06590bb65b4635a2e08b371b8499a
- SHA512 ddbd342a4ca794be549a26b67cd9dd57282885f11ee8a31563f6eec91d1b3f07720c1ce4cc676138c57d595caad9c5397d1bd49862fa368081ee50ee0ce2783c
- SSDEEP 98304:kTzodN0oAaldmdmnpWTIOSAW6hezSC6v2XMHy:PdCKmd0ATfi6W5
- TLSH T1B5867C03B2E446A6D06AC13DC9A24939E7713C1E4BB2D6DF3144BAD92D737C17A36722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Downloads\GroupResize.bat-
- Size 7.8MB
- SHA256 5f52767afd856c88e2fc22aad90d4c7cafe6dc3c68ada6b042bf2ac50911b01a
- MD5 3658e639ea0c35b4dddc380c867e8046
- SHA1 27990aa4e5dc6bba4bb468c32ebe3bed96dcb67a
- SHA512 d6118bff78b388c1f59d9e05ebadf0c3479aa730e5b1ab4808bd7830acfcef83456d00a7b7a9f828c9cad6ab0463423c96f42252292b8193d3723cc0b3ddd329
- SSDEEP 49152:kdJDp5AVBXdct+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWT3S9tsgXJ:kTzodN0oAaldmdmnpWTIOSAW6V/k
- TLSH T1AB869D03B2E405A6E06AD23DC972493597717C2E8BF2D2DF3144B9DA2D72BC17A36712
- MD5 SHA1 SHA512 SSDEEP TLSH