Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/04/2026, 13:00
Behavioral task
behavioral1
Sample
2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 7.2MB
- Sample260416-p84dcaaz4y
- SHA256 f07e968483df6e032c2cac67fbe79fd5c2a437e62324f8477b25fc6bcc6b547c
- MD5 580265d57672581ed9a3b7ddc6db121c
- SHA1 498be7c91aa758c1def6d8007d55de49442c4b20
- SHA512 72b9953f7300109b336bd04b9bae82ab43336b47251d1b3d235c7a573cd673094d373457969b7f8b7a17cf3944c25672d6d0e71ef385b322fea85a987d976eed
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqh:Z3qqUHxqPF4VMNP60joX0oAaYdnRBR
- TLSH T13C762903F253899AD191D134C951C632E6313BAD47B344EFF96CB298EA3B6E36538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\compact.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\svchost.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5188-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0005000000014297-5.dat upx behavioral2/memory/5188-775-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5188-3180-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.22000.1_none_f9cba295aacd52e9\ucsvc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\r\VSSVC.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.22000.37_none_4ebd7bd997a97fcb\wifitask.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_da8c01e10676f001\r\sdbinst.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.22000.1_none_615eec7b6e862785\fc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.22000.1_none_31352ed24fc2d65e\psr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\f\WUDFHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.22000.65_none_9f7612893c144c09\f\smartscreen.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\vdsldr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-write_31bf3856ad364e35_10.0.22000.1_none_b5c66fd5e1e0f0bf\write.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_76ec1420387eb344\csc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.22000.1_none_4fe921868d7ef368\mobsync.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userinit_31bf3856ad364e35_10.0.22000.37_none_be275aadedb23f4a\f\userinit.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_478d6c55833b17ab\f\dcdiag.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.194_none_3a6786958001450b\r\wowreg32.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.282_none_5faf7b34bce42c4c\SearchFilterHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_3af3f70bfdcd4fb1\reset.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.22000.120_none_8fd8aab412295721\mpnotify.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.22000.1_none_810efa0e3f0e1154\wermgr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..-diagnosticsmanaged_31bf3856ad364e35_10.0.22000.1_none_c52a6f9591cae974\stordiag.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.22000.1_none_935f3ba28807f81e\finger.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.22000.1_none_02421d570600c786\WMIC.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_34cab29cacfab0ca\Pester.bat- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.1_none_0384636b13b61c9e\TiFileFetcher.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.22000.194_none_a9ffdf7b2efc21ec\f\wuauclt.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.22000.1_none_a341a57910bc73cd\wab.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.22000.1_none_1e8441ad180b2608\TsWpfWrp.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\f\LaunchTM.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.22000.1_none_58ed24a5c85940dc\sapisvr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\VSSVC.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_c66bd96c36769493\r\wevtutil.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.22000.1_none_0d83a5e891b3d321\ftp.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.22000.1_none_6565a69e82761dd2\icsunattend.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.22000.1_none_ab670d45e251ddba\forfiles.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchProtocolHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.22000.120_none_30f8a86da4d47388\f\sfc.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.22000.1_none_de173b06bfe08f32\InetMgr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.22000.1_none_9033bf3e0d1a2461\SMSvcHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\SearchFilterHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.22000.318_none_aa689c124bcde8ee\CheckNetIsolation.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_845be02a96edce3b\dxdiag.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_3d11f25cbb74100a\f\sdchange.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.22000.1_none_a192cd380c242ff3\SystemPropertiesHardware.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5f6e7d4cbd14f8f7\r\SearchIndexer.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-diagnostic-results_31bf3856ad364e35_10.0.22000.1_none_7f29d071eb745e94\MdRes.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.22000.1_none_9a93850442801f9d\odbcad32.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\r\runas.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.22000.258_none_570e91ed5ac8ebe3\r\Microsoft.AAD.BrokerPlugin.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shutdown-event-tracker_31bf3856ad364e35_10.0.22000.1_none_5917b556ccc10b5e\shutdown.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_f9601eae71d90785\r\TpmTool.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15806.0_none_814d9cd431d93bd0\aspnet_regiis.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.22000.1_none_de6b1af4069aa942\dpapimig.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.22000.282_none_d037578ed2162e06\f\sdbinst.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.22000.348_none_67702744b34d2d9d\r\HelpPane.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.22000.1_none_03f10908532480fe\PickerHost.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.22000.1_none_def881a82cc4feb7\Ribbons.scr- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.22000.1_none_f159656ce5b94cb8\tpmvscmgr.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\r\nltest.exe- 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-16_580265d57672581ed9a3b7ddc6db121c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5188
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.8MB
- SHA256 06e85f490f3d8f86950fe96c8718cbb2b48b71959965ddd09e9594bd6d8b9e4c
- MD5 c348e5a3a551323155d904b4f139efd2
- SHA1 840984d54ff5c362ea2b703e54c7dcc4ead256ae
- SHA512 0412a898e36f8b8041959c59e1a68f782f8168bba945600ca570fe6e2f403ae413418b253a9134b995c36e41a77e0f0993209f4f723ea16e01c2905c1854bb15
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYdnRBljox:ZaHxXMZ6+oEvdnDxox
- TLSH T12C863903F253895AD1A1D134C951C632E6313BAD47B344EFB95CB298FA3B6E36638B11
- MD5 SHA1 SHA512 SSDEEP TLSH