Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
- Size 4.6MB
- Sample260415-c9sa9ahs6x
- SHA256 516e2d9ad75c4463e33367a0a33b98756913ec0da6e0f65a09328de10ab47d00
- MD5 fbef7d8598e753de1a24eb08936e558f
- SHA1 2f32efcfdc402c9fd14d7d03e1f091d74a3d899e
- SHA512 fb97ec4e5964072eac4a5dac412f63fa2a0842011b2250983cbe923d55092840ead4b8993d17a425e50d56ffaf1650dacb486145c379cabd3862b1923e52d6b9
- SSDEEP 49152:CmlJciX15IJv/pKKCECpExtwDzS9MAvM6+kuXunb7Q97/tKJ+AaLLeNF7pbhCtII:jwJ0Py9Mt/XuaK+EhC4E
- TLSH T146265A53A36510B8D46FC8B4CE29552296393C8A43F496FF26D876F51A32ED43B38F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regedit.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{A32B1890-3A43-4988-9723-087C4F57D342}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Solitaire.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\SnippingTool.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstaller.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\SoundRec.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.22000.469_none_403fa699a3654657\f\MDMAgent.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\spoolsv.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\f\rdpshell.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.469_none_574c4adf3362fbca\f\explorer.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.469_none_5704c6175ad01b79\f\Microsoft.AAD.BrokerPlugin.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\f\SIHClient.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\f\SearchFilterHost.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.22000.120_none_f07c0067839c600d\f\RMActivate_ssp_isv.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.22000.65_none_f3a35be8937453f0\f\TabTip.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_curl_31bf3856ad364e35_10.0.22000.434_none_841ec22dd6bd92c4\f\curl.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpconfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..pickerhost.appxmain_31bf3856ad364e35_10.0.22000.282_none_08c227a0c7c9c4c1\f\ModalSharePickerHost.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.22000.282_none_eb29ce0d02c88de7\f\ntprint.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\diagtrackrunner.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup360-media-base_31bf3856ad364e35_10.0.22000.469_none_259c259bf9e2d267\f\SetupHost.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\dtdump.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.22000.469_none_e653782f0144d814\f\SysResetErr.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\splwow64.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\f\SecureAssessmentBrowser.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_a6af4a93eb065fad\f\RMActivate.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\f\TpmTool.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\f\WSManHTTPConfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\bfsvc.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.22000.469_none_b104ba5249e06dec\f\FsIso.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.22000.120_none_e4b70edd74d735f3\f\RMActivate_isv.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.22000.469_none_ddccf236be43e7c9\f\memtest.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\f\PktMon.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros..x-deployment-server_31bf3856ad364e35_10.0.22000.493_none_e73dfe4d18ff7931\f\CustomInstallExec.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\f\wevtutil.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3a8cfd7d7fe46760\f\wowreg32.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.22000.120_none_f698302c22284569\f\XGpuEjectDialog.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\f\MoUsoCoreWorker.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\f\fixmapi.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_10e4c14208d6d2d3\f\wmpshare.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_037bca9e287fff5c\f\quickassist.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.22000.120_none_3da444c93fbedacf\f\OOBENetworkCaptivePortal.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.22000.132_none_23ef129810e14356\f\RecoveryDrive.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\f\sdbinst.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-mediafoundation_31bf3856ad364e35_10.0.22000.120_none_a2190a6cc64fec46\f\mfpmp.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4624 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe 4624 2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_fbef7d8598e753de1a24eb08936e558f_akira_cobalt-strike_darkgate_elex_gcleaner_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4624