Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/05/2026, 11:07
Behavioral task
behavioral1
Sample
2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 9.8MB
- Sample260506-m73pbaf191
- SHA256 4a95e25684f8f8a238f52dbb09e1e7189558b222f3d43f99bf903814cb2e9c63
- MD5 797fb1c46ad2d1b72daee95db7ea911e
- SHA1 35d3d6cfe11e2161b9d10b950bf9ee1947c6a96a
- SHA512 9286cb0fc09396a381277e6193771016e03d2a1d906993d9e41fa9cfb56e16dab362ebd2dcad9062e89ef565392410b5e60518c16feea656ec4fc2a5069d6824
- SSDEEP 98304:qYg293wXmoKxdH4AxizdH4AnIo6qzBPxNSslfAjoA:qYX93vTxdYAYzdYAgqzBHzSoA
- TLSH T11AA6291172D98FE8C05FD074CA4666A696237C868F619FDF09807E293E766F06E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\getmac.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\chcp.com 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\write.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\relog.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cacls.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regedit.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cipher.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\hh.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\logagent.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\newdev.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regini.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\where.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\proquota.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe -
resource yara_rule behavioral2/memory/4076-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000700000002a8ee-5.dat upx behavioral2/memory/4076-732-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4076-3186-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.22000.376_none_d180c9ec46d962eb\f\splwow64.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecensus_31bf3856ad364e35_10.0.22000.120_none_aad7a0687fb44b43\DeviceCensus.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.22000.348_none_a3b217b55cca1de2\r\IESettingSync.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\r\runas.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.22000.1_none_674facc3fa15e905\RunLegacyCPLElevated.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.22000.1_none_1cbb979e0acb2320\WSReset.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817\ssText3d.scr- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.22000.376_none_fd0b376d9072c88a\f\rdpclip.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.22000.1_none_6f06193e8c8d8938\chkntfs.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.22000.1_none_845be02a96edce3b\dxdiag.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\wscript.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.280_none_a8651901944b2dc3\TiFileFetcher.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_windowssearchengine_31bf3856ad364e35_7.0.22000.348_none_5519d2fa88b436fc\f\SearchProtocolHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\f\ApplySettingsTemplateCatalog.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.493_none_fb990c63ce4d223c\f\tcblaunch.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.22000.348_none_571935de2408ae28\r\slui.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.22000.318_none_9b6af6ae8c0ac6cb\f\runexehelper.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.22000.65_none_90fb210207715818\f\Taskmgr.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.22000.1_none_00019ee11f850b6d\calc.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.22000.1_none_0367376385127fe1\FXSUNATD.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.22000.1_none_f6bb136dce337547\driverquery.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.22000.71_none_1c87d1fdc5c5037f\f\raserver.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.22000.282_none_71c617f769fc171d\r\SpatialAudioLicenseSrv.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.22000.1_none_7e8245ff5f1eec69\taskhostw.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_wpf-presentationhostexe_31bf3856ad364e35_10.0.22000.1_none_c637d0f724e6f1a9\PresentationHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-csvde_31bf3856ad364e35_10.0.22000.1_none_55632d7a2ef05cc1\csvde.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.22000.1_none_c36af850083330df\PresentationSettings.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.22000.1_none_40fab150342df168\refsutil.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.22000.120_none_32bd480a87134e0f\msra.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.22000.318_none_065139dac533d14e\f\SppExtComObj.Exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-more_31bf3856ad364e35_10.0.22000.1_none_0cf29863523884a8\more.com- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-waitfor_31bf3856ad364e35_10.0.22000.1_none_16fdfdd9b45d6e53\waitfor.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\tcblaunch.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.22000.1_none_9b2806fb34e0407f\dispdiag.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.22000.282_none_069016efd47610d8\f\wmpshare.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.22000.1_none_a7a700c8f53b4106\mount.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.22000.1_none_b7671877039e31c8\diskperf.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.22000.1_none_9d236d8db8081199\rstrui.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.22000.1_none_3a2434f5fe6af698\esentutl.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-secinit_31bf3856ad364e35_10.0.22000.1_none_e850387006280e7a\secinit.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\rwinsta.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.22000.1_none_ffcf293574d7aaf5\appcmd.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.22000.1_none_aa19bcc4bf43b810\msiexec.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.22000.1_none_c4e0220059a427b2\CredentialUIBroker.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.100_none_f82676266a17f522\ApplySettingsTemplateCatalog.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.22000.1_none_f7606706a9708e33\wslconfig.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.22000.120_none_f759261c81fa2ed8\SecureAssessmentBrowser.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_c24a28fb71aa07c9\r\Robocopy.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.22000.318_none_40ba790c85795e91\r\BioIso.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..monotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_618940d4a376d501\r\MoNotificationUx.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-consumers_31bf3856ad364e35_10.0.22000.1_none_a115c50e5daa7435\scrcons.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.22000.176_none_161fead9a85c45cd\GenValObj.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\n\MiniSearchHost.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-exe_31bf3856ad364e35_10.0.22000.1_none_d0b58ed08fdbb9ff\cliconfg.exe- 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_797fb1c46ad2d1b72daee95db7ea911e_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4076
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 10.3MB
- SHA256 de0e6e2c54db9fbca82d06a26776e6a12b51a8600033b014d62f9a8f63515b05
- MD5 2d779ef5928d094d99960bb690ccff93
- SHA1 16c7f69111c98c535fb9e450ce637bf541f9380c
- SHA512 f2598af22387c16a8691ab5d8efd7a53821ba9f61eda87ff4edd5cac2830a63cd9bf9417313947d0a87d4294d0c8315805026d44fc39a9d8cccbcbc0efabbe8e
- SSDEEP 98304:qYg293wXmoKxdH4AxizdH4AnIo6qzBPxNSslfAjoYjox:qYX93vTxdYAYzdYAgqzBHzSo6ox
- TLSH T114B64A1171D98FE8C05FD074CA8666A696237C858F619FDF09807E293E766F06E3422F
- MD5 SHA1 SHA512 SSDEEP TLSH