Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 09:40
Behavioral task
behavioral1
Sample
2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe
- Size 2.1MB
- Sample260420-lncs4sey4m
- SHA256 a550d670860e29ebb402f435f04f8b3878bd0bb337fd27441f0a6cd0d2f810a4
- MD5 bb540282a0e76ad4ce166a2b57055e2c
- SHA1 6ed0839d8c94473ef15795a29521bafdd287206a
- SHA512 50f7ffe4e5a89a23ac4080e19d58357442b657839fd1289e1c4495ebe6b3b40fa191bb3f0ee75f06a3a392d359d74b7dc1463b4810eb0d48269d98084eb181ed
- SSDEEP 49152:fkYwZsKlOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmcTdcoT:fAsdqqUHxqPFV
- TLSH T188A58D13F6D401E8D06AC234C7599122EA71FC5A0B24BADF16A897291E77FF06B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\hh.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\subst.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe -
resource yara_rule behavioral1/memory/4312-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/files/0x00130000000242a9-5.dat upx behavioral1/memory/4312-1291-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/4312-3196-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7000e6adf00c3d30\CloudNotifications.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1_none_595f2a7acaf53bba\WpcUapApp.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.19041.746_none_7a559100246cff2b\r\CloudNotifications.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-magnify_31bf3856ad364e35_10.0.19041.1266_none_ed4855448241f7e7\r\Magnify.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.19041.1202_none_fceb29af5a61f7e6\r\bcdedit.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\UwfServicingMasterScript.cmd- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\ShellLauncherConfig.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_ee822d264112a470\powershell_ise.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\f\Win32WebViewHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\r\wbadmin.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\8e36994536e5d701189b00001815341f.iisreset.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.19041.1081_none_ae0369bc9fe47e6c\appidtel.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_10.0.19041.1_none_d1d4cd9c4b409594\TabTip32.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.746_none_d8baedf8d09aba05\ThumbnailExtractionHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.19041.1_none_a6017688e5093466\dcdiag.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_b6b7b206d4b9d895\comp.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.19041.1_none_61af30d6b8e070e1\sort.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\f\relog.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\f\tttracer.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\r\VmComputeAgent.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\f\SrTasks.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\EoAExperiences.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.264_none_223a5768a6257099\CustomShellHost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.19041.746_none_122a74c9827fe81a\r\IEChooser.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systray_31bf3856ad364e35_10.0.19041.1_none_a9428a56956799d8\systray.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-control_31bf3856ad364e35_10.0.19041.423_none_81cc87a43da05fd1\f\control.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.84_none_bf1eecf3f472e3ce\r\Defrag.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\f\WaaSMedicAgent.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\adamsync.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.1_none_ef230558c150a821\inetinfo.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\WerFaultSecure.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_f962ab5f47e1e896\r\iisreset.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.19041.1_none_9ffa8bc52ecc9e29\comrepl.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.1_none_513ebdc8ffa81e3d\coredpussvr.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\r\DataStoreCacheDumpTool.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_6c428bc03bd6600a\winver.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_805f7a2ac157fb08\MuiUnattend.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.19041.1_none_598949f46770a8b9\dplaysvr.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\omadmprc.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\r\uwfux.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.19041.1_none_c991318e4b11e4cf\RMActivate_ssp.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-daf-pospayments_31bf3856ad364e35_10.0.19041.1_none_0b83240c6bc26a13\pospaymentsworker.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.19041.1_none_f509d2f29c00c5f0\services.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.19041.1_none_c3f8c36f1ece6e4e\ilasm.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.19041.1_none_81f73568e4ce1819\DeviceCredentialDeployment.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.19041.746_none_a39f6d9ab59bd8b7\MpCmdRun.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.19041.1_none_7e723dd43021c2d3\ImagingDevices.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\conhost.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..atedusermode-kernel_31bf3856ad364e35_10.0.19041.1023_none_5c93ef2449c89609\r\securekernel.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\f\spoolsv.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_aee92417063babbe\f\WinRTNetMUAHostServer.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\f\wlrmdr.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15805.0_none_7d38f956251354fe\mscorsvw.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.19041.1_none_9470ed79dcf5eade\help.exe- 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_bb540282a0e76ad4ce166a2b57055e2c_akira_cobalt-strike_elex_icedid_luca-stealer_njrat_smoke-loader_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.6MB
- SHA256 c39abd54710cdc7928bdeb015895cf9a6649b2fcc61581607fed8f2b64910da3
- MD5 cc5b0476eb01e7539edb0ac32d3fdbd3
- SHA1 ecedb8cfb79f1b3a17588519f2ce4dfdd998f77d
- SHA512 ca93ee7e915c4c4d71a645bdc7bf479bebae37b6119934fd660f366a44b6b80f29068a5190f97b58b73e900ff7bae9dae5f68561d64fe26995329bae1cd4945a
- SSDEEP 49152:fkYwZsKlOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmcTdcozPji0Ajn:fAsdqqUHxqPFxjoD
- TLSH T17ED59F13F6A442F4D076C174C6969626EA71B8460B34EACF03A597292F37BF09B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH