Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/04/2026, 02:49
Behavioral task
behavioral1
Sample
2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 10.7MB
- Sample260428-da9xpaf19l
- SHA256 11805ba643b79a7c9d3f7b4d56753490984dca53ace7b679554a1cb1d028ded4
- MD5 6eb23398235918fe85a1aaa7ba12208c
- SHA1 59a2f84b0aa9d6dc2f7ec2d7d49904dd835a587c
- SHA512 2920c55e82ca3c504d4e33a86c945f96e89e0f9eb9a4bed77dabffc6681bbaee111b7606b0f70f9bf4d73b6e237c4e28d84306be0cff899c36854c192cd6d2de
- SSDEEP 98304:Z3qqUHxqPF4VMNW6o0UyL6HtItjkgcfFcNFcEuwLNe9ajRpoG46eH26Z5xF7x5QD:ZaHxXME6o966HtIto0Ap6g5qPKrdO
- TLSH T15AB64B55F272267DC2278578819A9E73FD3038451B208DFB8189F7742E37AA8953EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\edpnotify.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\winver.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runas.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\comp.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\find.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fc.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\findstr.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msra.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\finger.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\logagent.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net1.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/1908-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001d00000002b1fd-5.dat upx behavioral2/memory/1908-631-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1908-3174-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.22000.41_none_46e53612c0e92204\BdeUISrv.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.22000.282_none_cfe0738266c4e593\f\winrm.cmd- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.22000.1_none_1b78a2bc0a780f77\DFDWiz.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\f\wevtutil.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.22000.282_none_55f322479d33cb0a\VSSVC.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15806.0_none_de9c072f19e4a666\vbc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.22000.318_none_95d72c738176ed2a\nltest.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_curl_31bf3856ad364e35_10.0.22000.434_none_79ca17dba25cd0c9\curl.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\r\AppVDllSurrogate.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.376_none_c7a79de54d7799ec\f\SyncAppvPublishingServer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.22000.348_none_67702744b34d2d9d\r\HelpPane.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.22000.1_none_02971972479d3255\dfsvc.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.22000.1_none_34c37d9c426177d3\help.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.469_none_04a25ac34c904574\TiFileFetcher.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.22000.493_none_31b28f9ae4503c95\f\vmms.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.22000.120_none_3023ad156f648a5a\CapturePicker.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ftp_31bf3856ad364e35_10.0.22000.1_none_032efb965d531126\ftp.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.22000.434_none_4f4ac04322f04123\r\PktMon.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.22000.120_none_334ea48b976d3bd3\f\CHXSmartScreen.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.22000.120_none_d7d3a12b5c67df85\iexplore.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.22000.1_none_a115457b00f4576d\iediagcmd.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.22000.120_none_3da444c93fbedacf\OOBENetworkCaptivePortal.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.22000.120_none_83fc3979242f7e2e\CustomShellHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.22000.1_none_c35886f1ae4523bc\EaseOfAccessDialog.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.22000.434_none_38ca096a17805fa9\f\lsass.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\wmpconfig.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\f\directxdatabaseupdater.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.22000.469_none_bc172f1a0215d298\wevtutil.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.22000.120_none_64d060998298410d\f\FileExplorer.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.22000.282_none_1a017429cb7fea2c\r\rdpshell.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_bsdtar_31bf3856ad364e35_10.0.22000.434_none_5be11e6025939378\r\tar.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..platform-media-base_31bf3856ad364e35_10.0.22000.376_none_d0bc762eaa58a5f0\f\SetupPlatform.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..pgrade-subscription_31bf3856ad364e35_10.0.22000.1_none_a7b29fe42d04be58\ClipRenew.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.22000.1_none_23fdac7926f37c5a\Windows.WARP.JITService.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.22000.282_none_ed4920c9a3fd8bd2\r\adamsync.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft.powershell.pester_31bf3856ad364e35_10.0.22000.1_none_2a76084a7899eecf\Build.bat- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.22000.1_none_ac5cd13c097cdc14\MSBuild.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.22000.1_none_cfdf17c0e1db180b\rasdial.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.22000.1_none_c3e1e602251fe636\Register-CimProvider.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.22000.65_none_99e34b544b7754a7\f\provtool.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.22000.282_none_6ae954e75a4dd338\f\winlogon.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.22000.469_none_5669b3acf1ecab58\r\winload.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.22000.1_none_383fdbeacdabdb26\tcmsetup.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4385d5a885bc9a36\f\cscript.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.22000.120_none_3fbde764cc71982b\eshell.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.22000.1_none_672d106ab99b6abc\iisrstas.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.22000.1_none_05bb63b2693533ca\TieringEngineService.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_0ca953877ffcac58\waitfor.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.22000.120_none_c073b3a01f4d4399\r\RdpSaUacHelper.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\f\SearchHost.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.22000.318_none_c7ea7e014d4524f4\AppVDllSurrogate.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.22000.71_none_ccb71d3ee4c7b8a6\ByteCodeGenerator.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.22000.132_none_7958838972f5ba04\f\LaunchWinApp.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.22000.1_none_a631d85ed7b16283\aspnet_regbrowsers.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.22000.120_none_285ae36df9fb90ad\f\OOBENetworkConnectionFlow.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.22000.65_none_64161fe87cb55cea\f\pcaui.exe- 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-28_6eb23398235918fe85a1aaa7ba12208c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 7c7b7a493afa81fa5a44460ecea61c206d0d993b553a8507af98d58cfebbbf19
- MD5 002178d16e6ea3ef1bfb3c329b6b9668
- SHA1 6a23852f8d6a06660895caa3e3057c181a07207d
- SHA512 0be00da900ff4aebcc708f7455a9337dc18b14ae4d8807c6dac4d779dea4bcb26b976f3a3c10f61a8e8b12130a6bd52ec82022c2705ec5c6485d851ca2e4cbf4
- SSDEEP 98304:Z3qqUHxqPF4VMNW6o0UyL6HtItjkgcfFcNFcEuwLNe9ajRpoG46eH26Z5xF7x5Qs:ZaHxXME6o966HtIto0Ap6g5qPKrd0oF
- TLSH T1E1C64B55F276227DC227C478819A9E77FD3038451B208DFB8189F7742E27AA8953EB31
- MD5 SHA1 SHA512 SSDEEP TLSH