Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 11:07
Behavioral task
behavioral1
Sample
2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 9.8MB
- Sample260506-m73pbaf191
- SHA256 4a95e25684f8f8a238f52dbb09e1e7189558b222f3d43f99bf903814cb2e9c63
- MD5 797fb1c46ad2d1b72daee95db7ea911e
- SHA1 35d3d6cfe11e2161b9d10b950bf9ee1947c6a96a
- SHA512 9286cb0fc09396a381277e6193771016e03d2a1d906993d9e41fa9cfb56e16dab362ebd2dcad9062e89ef565392410b5e60518c16feea656ec4fc2a5069d6824
- SSDEEP 98304:qYg293wXmoKxdH4AxizdH4AnIo6qzBPxNSslfAjoA:qYX93vTxdYAYzdYAgqzBHzSoA
- TLSH T11AA6291172D98FE8C05FD074CA4666A696237C868F619FDF09807E293E766F06E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\regedit.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\secinit.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\setx.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\whoami.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\choice.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\newdev.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\psr.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\help.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\label.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\msra.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\printui.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe -
resource yara_rule behavioral1/memory/4764-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0008000000024443-5.dat upx behavioral1/memory/4764-648-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4764-3196-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{B1BAA917-C618-452C-B29C-DC36AB9BAD16}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\firefox.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-f..client-applications_31bf3856ad364e35_10.0.19041.746_none_56f2f7338735a9a6\f\FXSCOVER.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5f557b607e14f541\ByteCodeGenerator.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_2d0e4759c01cf211\unregmp2.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.1_none_4eca52bc837e6422\BackgroundTransferHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.19041.1_none_1b575ad951209106\rdrleakdiag.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\f\ClipUp.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\f\setupugc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1_none_cc2783ead104d62a\winrs.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\WMIADAP.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.19041.207_none_4054ef70f69f6ff9\r\wpr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.746_none_e2c6a972a81b8d2c\f\icsunattend.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\wuapihost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.19041.546_none_f827f008f8832bd5\f\rasautou.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1237_none_b40cbfe2afd2c015\r\wowreg32.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSSVC.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.572_none_3e399e76562f6053\netbtugc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_8a7b0186743e499b\r\runonce.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_2afd3bd8e33c2cf2\f\msinfo32.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\r\netbtugc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslhost_31bf3856ad364e35_10.0.19041.117_none_9be21f0ef860b570\wslhost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.1202_none_05856bbd8f935e6b\f\DataStoreCacheDumpTool.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1_none_8fe667a6f213806a\AtBroker.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.19041.1_none_3d62a57d3b12dcf1\mode.com- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-timeout_31bf3856ad364e35_10.0.19041.1_none_4caa24969a02f9c3\timeout.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\setup16.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_2c2550df02273de3\wusa.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.1266_none_ab5bdb26141e0be5\f\vmms.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ntalcontrolsmonitor_31bf3856ad364e35_10.0.19041.1266_none_bfb5312df2d5c960\f\WpcMon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.906_none_9204c42a031e28cf\r\appcmd.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Speech\Common\sapisvr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\ImeBroker.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\f\Defrag.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.19041.1_none_3ea5f185c75971c2\Ribbons.scr- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\AppHostRegistrationVerifier.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFaultSecure.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.19041.1_none_69f4af04dd2c1f80\lpr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.19041.1_none_3062feae2a702d0a\cliconfg.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.19041.1_none_996ba223b673811b\dsdbutil.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.19041.1_none_513ebdc8ffa81e3d\coredpussvr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_4e1b852ddd390c0b\NetCfgNotifyObjectHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\immersivetpmvscmgrsvr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\poqexec.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.207_none_8d07de31084775c6\f\wuauclt.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\cleanmgr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.19041.844_none_6f27e9e1e7c4fb87\net1.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1_none_3cfd44d351b1a8ab\HvsiSettingsWorker.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\wusa.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-edp-notify_31bf3856ad364e35_10.0.19041.1_none_e112f07513949221\edpnotify.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\Robocopy.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\f\MBR2GPT.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\systemreset.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_f4a6d735c6ae17c3\GamePanel.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\BitLockerWizardElev.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\f\ssh-add.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\f\sethc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.264_none_d58a0ca50a94510c\vmcompute.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.19041.1_none_8171817405d01500\nslookup.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.3MB
- SHA256 de0e6e2c54db9fbca82d06a26776e6a12b51a8600033b014d62f9a8f63515b05
- MD5 2d779ef5928d094d99960bb690ccff93
- SHA1 16c7f69111c98c535fb9e450ce637bf541f9380c
- SHA512 f2598af22387c16a8691ab5d8efd7a53821ba9f61eda87ff4edd5cac2830a63cd9bf9417313947d0a87d4294d0c8315805026d44fc39a9d8cccbcbc0efabbe8e
- SSDEEP 98304:qYg293wXmoKxdH4AxizdH4AnIo6qzBPxNSslfAjoYjox:qYX93vTxdYAYzdYAgqzBHzSo6ox
- TLSH T114B64A1171D98FE8C05FD074CA8666A696237C858F619FDF09807E293E766F06E3422F
- MD5 SHA1 SHA512 SSDEEP TLSH