Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
21/04/2026, 05:58
Behavioral task
behavioral1
Sample
2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 11.2MB
- Sample260421-gn9qmacv31
- SHA256 f882a1c96a0dced6c6a4355927b64c48b7eaf1eedb9c1517636e5c8e2bec7cf7
- MD5 31d8b57da0e66ee2ead6b02cdd42f759
- SHA1 61620e8790338c4f9db29e8855795f685df6cebd
- SHA512 e6dec8c6fc443a444cf4e2f63385599e512a0b6d4129d40bb162dc9f58f433b50298e7d1fb8d21e2d3f3a1a279a1d85970cabbb26e989087dcaa2bb8c70cf2fe
- SSDEEP 98304:Z3qqUHxqPF4VMNP6T4jo+6d5jow0oAaldmdmnpCjo323SEyRV6G:ZaHxXMZ6+oto9Kmd0uo3CyP6G
- TLSH T18AC63902F213899AD191C134C9528662D6313F6D47B345EFB95CB298FE3B6E37A39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chcp.com 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmc.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\quickassist.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/3108-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e000000028e7a-5.dat upx behavioral2/memory/3108-678-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3108-3178-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\r\ShellExperienceHost.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\r\Spectrum.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.22000.1_none_49632d3770877d59\SETPATHS.CMD- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.22000.1_none_c0fd105a306dfcd0\netbtugc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.22000.282_none_03b4c900a639c980\f\TpmTool.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.22000.1_none_65f380faa4e1a1c3\PhotoScreensaver.scr- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.22000.318_none_f32072a930d121b3\f\vmcompute.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.22000.1_none_d76471adb6cf113a\InetMgr6.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.22000.469_none_82154d2009b8e727\r\MoUsoCoreWorker.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.120_none_7c599f579e2e019d\SpatialAudioLicenseSrv.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.22000.493_none_157ddf72a65679bf\f\sppsvc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winre-tools_31bf3856ad364e35_10.0.22000.65_none_ac11e3d68c043701\f\RecEnv.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.22000.1_none_ac71a9e770c9ec63\tar.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.22000.100_none_791efb09af53b896\f\AgentService.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.469_none_71e2bda169e58aea\r\audiodg.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.22000.282_none_f927204bf41f3d61\f\quickassist.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15806.0_none_63e43513a2a96ff5\WsatConfig.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_4.0.15806.0_none_c6dd19dedb079b8c\CasPol.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.318_none_5cc755143bc62566\r\CustomInstallExec.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dns-client_31bf3856ad364e35_10.0.22000.1_none_38261a83872276db\dnscacheugc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\appcmd.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.22000.1_none_6d6f4cb018f2ec3c\csc.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.348_none_7c4c059b9e36fe85\SpatialAudioLicenseSrv.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.22000.1_none_b181c8fde74dcdf7\csvde.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\f\WebExperienceHostApp.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.22000.1_none_0ce592401aadd3a5\PasswordOnWakeSettingFlyout.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.22000.71_none_8e1bee8f157fdd6d\f\msinfo32.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\UevTemplateBaselineGenerator.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.22000.100_none_1c26ef58a3003bf2\r\SystemSettingsAdminFlows.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpersonalization_31bf3856ad364e35_10.0.22000.1_none_95efb09bcb1d48b8\InputPersonalization.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.22000.1_none_0f97a0bb2461b363\WmiApSrv.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\f\Robocopy.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.22000.120_none_fc8d986a0ba4c584\r\AppResolverUX.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.22000.493_none_5c6bd6283c0b8362\CustomInstallExec.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.22000.469_none_bc884b259290e3bf\DeviceEnroller.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.22000.132_none_f836cc528422524b\ShellExperienceHost.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.22000.41_none_ea5a28018e2bb582\f\hvsimgr.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\iissetup.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.22000.1_none_45947734591e316d\mobsync.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\r\BdeUISrv.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\WebExperienceHostApp.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_58ed4d9536066242\Utilman.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.22000.282_none_d1df129ba9a9b56f\fsutil.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.22000.282_none_3d368ddb21bde8c7\f\rdpshell.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.22000.65_none_5df9e0d1a9b3658b\f\Spectrum.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15806.0_none_faab7cfee8f12dad\ngen.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.434_none_95bd8d59818abcd7\f\nltest.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.22000.282_none_66112670800af37c\f\vds.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\ScriptRunner.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.22000.434_none_eb6ed0d1cadda675\r\dcdiag.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.22000.1_none_b1116c83034868d0\BrowserCore.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.22000.1_none_0201c0f91e4bfdd6\sort.exe- 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_31d8b57da0e66ee2ead6b02cdd42f759_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.8MB
- SHA256 c8268d3c684a065f1d46fb3b5334e9275cfb8ed831db8235a33d755d44815383
- MD5 a8a2edaeb6760ef0eb8db75fb930573b
- SHA1 b89c49fc4beef7ddb234831ea1dba4fd3d9f0bd9
- SHA512 e3dcb10a45f673def919c995712136b5285871eb18f1b46a987caa0039f37fff3355585507c1d3d0690828e9a0ad4661cfd0ca2e853a851222863c0cf0af9da0
- SSDEEP 98304:Z3qqUHxqPF4VMNP6T4jo+6d5jow0oAaldmdmnpCjo323SEyRV66jon:ZaHxXMZ6+oto9Kmd0uo3CyP6con
- TLSH T1E7C63A02F2238596D0A1C134C9528666E6313F5D47B345EFB95CB298FE3B6E37A39B10
- MD5 SHA1 SHA512 SSDEEP TLSH