Analysis
- max time kernel
149s - max time network
117s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 14:34
Behavioral task
behavioral1
Sample
2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
- Size 3.2MB
- Sample260415-rxstkscs5t
- SHA256 0d741fa468ac943133aa3764445d44c0d8ffd0f27ed7551fe997ff43e0193b46
- MD5 a7eabd194d3e996d671e95a5c8769c52
- SHA1 3998a7ca6a45499fc6b36e93c55feb769a4b429e
- SHA512 f518fc9279036e1baae753b0c4afb8b1bd9d04dcdced7dcfe48b234c2fb534b97bc447549c643a5d3948f7ba24b3c9b73630a1f641dcf2ad8125faee444e84c1
- SSDEEP 49152:0XvkYwHSSoc9IW1dXgfC/MHmgIqJtb2I9Pji0Aj7:SEgc9IW1dXgfC/MHmgIwjo/
- TLSH T101F5E6CEFDD38E27C0A250708591975DB5303FC40625B987E259BB69EB3EFA0A52D321
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\perfhost.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\write.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\mshta.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wextract.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\convert.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe -
resource yara_rule behavioral2/memory/5080-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001d00000002b1d4-5.dat upx behavioral2/memory/5080-979-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5080-3210-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.22000.1_none_7f6d0f07b0ce31f2\qwinsta.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.22000.1_none_582cc1ca37f0fcbb\ilasm.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\r\msinfo32.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.22000.120_none_dd24c7cd1fc6d4b1\f\PeopleExperienceHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.22000.1_none_ff7542ad94a3dbc5\PING.EXE- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\r\VSSVC.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_windows.networking.vpn.nethost_31bf3856ad364e35_10.0.22000.1_none_23bf602c090692bb\NetHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15806.0_none_8e3cbaaac5859590\aspnet_regbrowsers.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.1_none_465406ab4a74c15b\dcdiag.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\SpatialAudioLicenseSrv.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\WUDFCompanionHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\chgusr.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.22000.1_none_b7c933829422be28\netiougc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..tofservice-oposhost_31bf3856ad364e35_10.0.22000.1_none_dd6521dd430a0c17\OposHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\explorer.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_659b5b6317001d2c\f\runas.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.22000.51_none_35df5a459d516a9e\omadmclient.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.282_none_59d63580ebab6c4c\r\WpcTok.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\r\FileExplorer.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\TextInputHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.22000.194_none_213203c52af71b4b\bfsvc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.22000.1_none_91ac9ca5e0bd52f1\gpupdate.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.22000.1_none_2f02b4dfdc90d704\PerceptionSimulationService.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.22000.1_none_81f1372fe02ff0d7\printfilterpipelinesvc.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\sdchange.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\r\msra.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros..x-deployment-server_31bf3856ad364e35_10.0.22000.493_none_e73dfe4d18ff7931\f\ApplyTrustOffline.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.22000.1_none_008a7e7adfc26529\dasHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_890a915053a73623\finger.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.22000.1_none_3adcb6f6de313c9e\cvtres.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.22000.1_none_c970ad52cf16bc2f\diskpart.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpconfig.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.22000.318_none_8e5804ec62c5891c\r\cmimageworker.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.22000.1_none_f24d5bd1a5bd0380\resmon.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\r\ShellExperienceHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\r\SenseNdr.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.22000.1_none_398d4981eff37ba2\perfhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.22000.1_none_861646fd953a616a\taskkill.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\pcaui.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.22000.1_none_70698255615a88a2\sdiagnhost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\r\CustomShellHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sqm-consolidator-base_31bf3856ad364e35_10.0.22000.1_none_2a83098f66602d2f\wsqmcons.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.22000.1_none_eb18e02f1096ae08\SystemPropertiesRemote.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.22000.1_none_388372a9953bb48f\iscsicpl.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15806.256_none_4e9ea93e588a5995\aspnet_wp.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.22000.434_none_4a9fb8788572dd19\r\ldp.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.22000.1_none_46530ac7e8bd39fd\fveprompt.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.22000.318_none_7fdfd2b2e06a7af9\r\nvspinfo.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_c637d0f724e6f1a9\PresentationHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.22000.1_none_ef1ce2dee8e9f117\BackgroundTransferHost.exe- 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_a7eabd194d3e996d671e95a5c8769c52_amadey_cobalt-strike_elex_hijackloader_luca-stealer_njrat_smoke-loader_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 3.8MB
- SHA256 913689c2a64064acf8df249897cdcd0c54108885679d0246126d945e03f91799
- MD5 5c46a58e78f7b2f845de9fbc77a941a9
- SHA1 673201b860001512d255e1021fb7af653e1889c6
- SHA512 2c8f7d850c409fbc846be66ad7b2a860316ac5b2363cbe25c92127e82b65e02905fbf471ecc703206be82a789b321ba24a07a01bff3bfec9972e8d953c04cf80
- SSDEEP 49152:0XvkYwHSSoc9IW1dXgfC/MHmgIqJtb2I9Pji0AjLPji0Ajr:SEgc9IW1dXgfC/MHmgIwjoPjoP
- TLSH T16106E69EFDE28E27C0629070C591975DB5313FC10721B987E249BA29EB3EFA1953D321
- MD5 SHA1 SHA512 SSDEEP TLSH