Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
15/04/2026, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
- Size 8.1MB
- Sample260415-sg43caa12k
- SHA256 310d7931dd935fa632eca5587966f65d909274c719e1272108f2604da45674fa
- MD5 b778eb2b67576f6fae4f069271ac7179
- SHA1 fff4a9c6a2f5b504245edaf6060b7087447d682f
- SHA512 6d28dcb2f8c943e293d46df7d8265dcb4090582afd79ab3b89ed0c53276031322c9ef5327c98fa61e058f90dcd9b9abe0fbd8279f3f3597f791027d607f37fb8
- SSDEEP 98304:kqcKjoS5xKUgTH2M2m9UMpu1QfLczqssnKSU:Lcsos3gTH2qBpu1QfLIqsufU
- TLSH T1D386F71165D98FACC05FD474CE4665A5AA233C468F20AFDF0981BE293E766F05E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\sort.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\curl.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\upnpcont.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\where.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cmd.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\quickassist.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\setx.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regini.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\SpatialAudioLicenseSrv.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\vds.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.22000.1_none_b6f59fcb95517038\srdelayed.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.22000.120_none_9268b7169b04c4a6\ClipUp.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\UevAppMonitor.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.22000.1_none_5e2e482310a0f2c5\rekeywiz.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.22000.1_none_da2a87582afb2453\UserOOBEBroker.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3012dc434ba08310\f\wowreg32.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.22000.434_none_1c2ba06bc5084235\edpnotify.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\IESettingSync.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.22000.120_none_8faca973dc064b74\NarratorQuickStart.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..installerandprintui_31bf3856ad364e35_10.0.22000.194_none_d171c2327b4ef3a7\f\printui.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.22000.120_none_576e8243334ab082\r\explorer.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.22000.1_none_12f1c1658a9d216d\mountvol.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.282_none_3066e216e524ffb4\r\vmwp.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.22000.1_none_19aa88b2908bff9b\choice.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\r\WUDFCompanionHost.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.22000.1_none_db5642aeddf1e2bb\PrintDialog.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.22000.1_none_049039c25c6cceaa\sxstrace.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rpc-ping_31bf3856ad364e35_10.0.22000.1_none_fe52560879e25943\RpcPing.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.22000.1_none_c29d51ccbc2353b7\CIDiag.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.65_none_a2e87bc198c20e5a\f\wevtutil.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.22000.348_none_790557e9d75b5a9c\f\SpeechModelDownload.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.22000.71_none_688486d306b27285\f\msinfo32.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.22000.1_none_586a6bf4f6a07942\GameBarPresenceWriter.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.22000.194_none_17fbd7504b9de242\f\SIHClient.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.22000.1_none_b5bbb79816b29fb5\forfiles.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_2f8cc74dbe756b7f\wiaacmgr.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_58ed4d9536066242\Utilman.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_9b4fcb543bd21a13\f\LaunchTM.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.22000.120_none_9c5aa041b6a59db2\f\RMActivate.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.1_none_ac71a9e770c9ec63\tar.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.22000.348_none_88dc8ff6981e1a22\f\VmComputeAgent.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vdsldr.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.22000.1_none_a28a13c3c2bf1e9c\pipanel.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.22000.1_none_05f7f490e9af5ded\MicrosoftEdgeDevTools.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.22000.1_none_5bdd347516f7252a\PresentationFontCache.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.22000.1_none_6bd596e0ba043609\imjpuexc.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.22000.1_none_2bf4b35abb6a6b63\EDPCleanup.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\CHKROOT.CMD- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.22000.120_none_b1071c7fd34df0e8\r\fixmapi.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\f\RdpSaUacHelper.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\f\SpatialAudioLicenseSrv.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\TextInputHost.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_4.0.15806.0_none_721a928100ad3217\RegAsm.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.22000.120_none_4a072e86b7c9806c\Microsoft.AsyncTextService.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_b61f094deaec819e\RdpSaUacHelper.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.22000.1_none_36e30e5c0bb5efc5\mmgaserver.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\MsSense.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\f\sdbinst.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\iisreset.exe- 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_b778eb2b67576f6fae4f069271ac7179_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 8.7MB
- SHA256 bff48bb0588cc5ed8d569d2df7376cbd614f4727bece58a29c3d16f130494a3c
- MD5 7cdf40d0b7f40a62c6fa67b02744d340
- SHA1 b02575929ff18f4f61a5e93545e9b3bb2ff89669
- SHA512 5a72bc036717792d0e8fdf9ff8cf36be50db45255af3cebaaa97c3db489ef1db9a5a643d81311c02ac772f272cb198ccec96f8bca84412ad679601497c57582a
- SSDEEP 98304:kqcKjoS5xKUgTH2M2m9UMpu1QfLczqssnKS0joP:Lcsos3gTH2qBpu1QfLIqsuf+oP
- TLSH T16496081165D98FA8C06FD074CE4665A5AA333C468F209FDF0981BE293E766F05E3921F
- MD5 SHA1 SHA512 SSDEEP TLSH