Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/04/2026, 01:17
Behavioral task
behavioral1
Sample
2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
- Size 21.6MB
- Sample260416-bnnv9sgx21
- SHA256 111f52ff713f120e163aa6dacf58f484f523d7754ae58b19c411a63190cb1ecc
- MD5 e898203aeb16a7026160d36c762ef28a
- SHA1 ff0bc9c274c4d3f521cf3c46edb05307c6c90972
- SHA512 a9bacb6810c9a80ed1017bcbedc4350c27d6e2447760ce6ad94ffd03b58e99eb0fca71151c5d488cf9bbd060d20a5a22419c3eafc0952ce47a0210bdc689e15c
- SSDEEP 196608:2a5nU64sgQvNt1Z6iQGlgTH2qBpu1QfLIqsuf8:6CgaNvKGCTHNBpu1Qfc08
- TLSH T111374B4136E54AF9D06BC170CE6296B5E9727C814D31ABCF1150BE1E3F37AA05E3932A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\calc.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\expand.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\user.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\relog.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\dialer.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\help.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe -
resource yara_rule behavioral1/memory/1644-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x000a000000024277-5.dat upx behavioral1/memory/1644-290-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/1644-3224-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\144.0.3719.93\elevation_service.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\7-Zip\7z.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvax64.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..b-standardcollector_31bf3856ad364e35_10.0.19041.264_none_0f23d07ed2574292\DiagnosticsHub.StandardCollector.Service.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\csc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\CustomInstallExec.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_c77fb947e9eed73b\r\cscript.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\f\dsdbutil.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_adf98e02f565c8fe\lodctr.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.19041.1_none_c26c8624c595ae48\GameBarPresenceWriter.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.1_none_d9d36ad7f915f657\fltMC.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\unregmp2.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.1_none_613e4ed2b91d35a0\fixmapi.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\f\quickassist.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\usocoreworker.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\convertvhd.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\reset.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_f8b0afde1e951639\f\WmiPrvSE.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\r\net1.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\f\schtasks.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_3bcd0306a19592e2\r\Robocopy.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\fontdrvhost.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\f\vmcompute.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.1266_none_8f272afdd624490f\f\sppsvc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_a9b815907b71fe1a\wowreg32.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.19041.746_none_045e85893c117e35\f\wksprt.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.19041.1_none_b5109d57c984cfcc\csvde.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_9e094af3987dca57\f\svchost.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\fc.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\f\UIMgrBroker.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.19041.1202_none_a27aa61d221bdc5c\f\wordpad.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_b6126993bc8370e6\SMConfigInstaller.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingShell.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_9478227a478f23d5\Pester.bat- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.19041.264_none_c1c396da5ea1410f\wbengine.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15805.0_none_0606cd4b5dabfc56\MSBuild.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_eda92e20fee7d318\f\PhotoScreensaver.scr- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\AccountsControlHost.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15805.0_none_a89f46f8bfac0a1e\AppLaunch.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\SearchFilterHost.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.19041.1266_none_56b9c0cf76f27918\autochk.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\DeviceEnroller.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.84_none_42927ae06bc1dce9\r\WpcMon.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\icsunattend.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\TSAppInstall.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.19041.1_none_6b184251474f0fac\w3wp.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.19041.1_none_23bb28d0952bcec8\RdpSaProxy.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.19041.1_none_861f5c69fbf3d066\AppLaunch.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_d9b4a5b5fd217f4b\dxdiag.exe- 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_e898203aeb16a7026160d36c762ef28a_akira_cobalt-strike_elex_hijackloader_icedid_luca-steale.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1644
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 22.1MB
- SHA256 18fc5d582214a250a9ea86de0e508d9ecb46aba51e1b734cbb6336b91d1a823e
- MD5 85c8f7217fc3d750dc26fb209f9f95de
- SHA1 8798985c474ece0b5960b9d56f8fdc3490125c4d
- SHA512 400666f94234fcfd7bfeb31813bb3dc4888a35476d409b7263838af86cbbc1ccef5aff4cb85aa8f78e47b268e288740b509fa1983bb2e468c834d495e378135c
- SSDEEP 196608:2a5nU64sgQvNt1Z6iQGlgTH2qBpu1QfLIqsuf2oP:6CgaNvKGCTHNBpu1Qfc0RP
- TLSH T1B5374B4136E54AF9D06BC170CD6296B5E9727C814D31ABCF1150BE1E3F37AA09E3932A
- MD5 SHA1 SHA512 SSDEEP TLSH