Analysis
- max time kernel
149s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/04/2026, 02:49
Behavioral task
behavioral1
Sample
2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 10.7MB
- Sample260428-da9xpaf19l
- SHA256 11805ba643b79a7c9d3f7b4d56753490984dca53ace7b679554a1cb1d028ded4
- MD5 6eb23398235918fe85a1aaa7ba12208c
- SHA1 59a2f84b0aa9d6dc2f7ec2d7d49904dd835a587c
- SHA512 2920c55e82ca3c504d4e33a86c945f96e89e0f9eb9a4bed77dabffc6681bbaee111b7606b0f70f9bf4d73b6e237c4e28d84306be0cff899c36854c192cd6d2de
- SSDEEP 98304:Z3qqUHxqPF4VMNW6o0UyL6HtItjkgcfFcNFcEuwLNe9ajRpoG46eH26Z5xF7x5QD:ZaHxXME6o966HtIto0Ap6g5qPKrdO
- TLSH T15AB64B55F272267DC2278578819A9E73FD3038451B208DFB8189F7742E37AA8953EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sc.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\replace.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\find.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ftp.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\more.com 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tree.com 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral1/memory/1952-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x00080000000243a2-5.dat upx behavioral1/memory/1952-596-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/1952-3196-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\FileExplorer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\LocationNotificationWindows.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.746_none_03030718c597d891\f\sdclt.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.19041.264_none_08acfd4a9926561a\f\wermgr.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\WFS.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\f\vfpctrl.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_876d2c71ceefefbb\appcmd.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\TrustedInstaller.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttp_31bf3856ad364e35_5.1.19041.1151_none_d57e154a0a8460d3\f\pacjsworker.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\f\vmms.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.19041.1110_none_a4bfcaa32abfcf0e\raserver.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.19041.1_none_22d9ddcd4b2b9d68\CameraSettingsUIHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.19041.1202_none_324ea383dbfddeb9\mavinject.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVShNotify.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ervicing-management_31bf3856ad364e35_10.0.19041.746_none_46f79836a0dc7206\f\Dism.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\unregmp2.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\f\BackgroundTransferHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.19041.1_none_b84e385529c68af9\unlodctr.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1_none_a353adcda7cf69e6\convertvhd.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.19041.1_none_8a237828132e61da\Pester.bat- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1023_none_2cd9cc4237e09b91\PickerHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.1_none_b89abd72d09ad54d\Utilman.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.19041.1_none_e12fdac08aa3b840\sfc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\sdbinst.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.19041.746_none_e5e33ba764e4ddec\bridgeunattend.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\ProximityUxHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1110_none_b678ec2deb73b201\sdchange.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_63078cde447629b6\cipher.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1202_none_dfaaff89afe4f3d4\r\vds.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.19041.546_none_5940d1a4fc4ad8f3\r\backgroundTaskHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.19041.1_none_c1f3db00edc86845\dvdplay.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVNice.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-orchestratorcore_31bf3856ad364e35_10.0.19041.1266_none_fb98272b39a47240\f\MoUsoCoreWorker.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\ea94772a36e5d701947000001815341f.tlsbln.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.1_none_a47f90601a54e2cd\dialer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.844_none_c171e0be75e709de\dsdbutil.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirdpclient.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.19041.1_none_4e5e653d48e95632\wextract.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_a4f6113bccc284b7\chgport.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\HOSTNAME.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_110072d23cfc00d3\UwfServicingSvc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\gpresult.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1_none_c36f57b8a28f2fbc\msoobe.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.1266_none_d92abf553d8a282c\r\MusNotification.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\f\MusNotifyIcon.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.19041.1202_none_24329c73afbd2316\r\DeviceCensus.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.19041.1266_none_c67a7a982eedc4e8\r\explorer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.19041.1_none_62dc6b73f7e78431\ftp.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\f\WindowsActionDialog.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\f\nltest.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.19041.746_none_2136afef5fadeaa4\r\prevhost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\ByteCodeGenerator.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.1_none_643da99ff70141b5\sxstrace.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\f\WerFaultSecure.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\IESettingSync.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\SecurityHealthService.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1952
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 7c7b7a493afa81fa5a44460ecea61c206d0d993b553a8507af98d58cfebbbf19
- MD5 002178d16e6ea3ef1bfb3c329b6b9668
- SHA1 6a23852f8d6a06660895caa3e3057c181a07207d
- SHA512 0be00da900ff4aebcc708f7455a9337dc18b14ae4d8807c6dac4d779dea4bcb26b976f3a3c10f61a8e8b12130a6bd52ec82022c2705ec5c6485d851ca2e4cbf4
- SSDEEP 98304:Z3qqUHxqPF4VMNW6o0UyL6HtItjkgcfFcNFcEuwLNe9ajRpoG46eH26Z5xF7x5Qs:ZaHxXME6o966HtIto0Ap6g5qPKrd0oF
- TLSH T1E1C64B55F276227DC227C478819A9E77FD3038451B208DFB8189F7742E27AA8953EB31
- MD5 SHA1 SHA512 SSDEEP TLSH