Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 12:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
- Size 7.0MB
- Sample260606-ptc8lses9x
- SHA256 6c8322f04f8634326385994b3be11462630a1b3ecfe25ee99a600abe7e867c5f
- MD5 cabe784967f74f19e3e76504503554f8
- SHA1 8593763026aed5a2373384251f239eda58a6dc60
- SHA512 62ea6817db0a973df955cf8babcd10a9a96acb621855d1b3a582803982ee0ab09f10d8356a19f7c44ebb7c3984003e2efde40cadb49c61469b1184416bc103f5
- SSDEEP 98304:7fkZcNKUgTH2M2m9UMpu1QfLczqssnKSb:zPDgTH2qBpu1QfLIqsufb
- TLSH T11D76E61161D99FDCC05FD474CE4669A56A237C468F20AFDF0980BE293E766B06E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\format.com 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\logman.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msra.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wecutil.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dccw.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\reg.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regini.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\setup16.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\icacls.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\regini.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Media Player\wmprph.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.22000.1_none_7ae3697a4deac0fe\ImagingDevices.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-lsatrustlet_31bf3856ad364e35_10.0.22000.434_none_dff7d1ca03eba43a\f\LsaIso.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.22000.1_none_ec45f23cf429bbd8\vbc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.22000.469_none_4b2e9fd5814459a0\winload.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\SenseNdr.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.22000.1_none_6341f7e76a67243d\Utilman.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.22000.1_none_eeb0f55fae54e327\wextract.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15806.256_none_7593da10f932a980\mscorsvw.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.22000.1_none_1baa132fc64be8aa\IEExec.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.2_31bf3856ad364e35_10.0.22000.1_none_1e1bb3d123f89974\InspectVhdDialog6.2.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.22000.1_none_54c6fd5d15027c02\regedit.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.22000.1_none_94dc1cd13c50e5b3\tzutil.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\Ldr64.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.22000.434_none_986ff8587a758e7c\f\WUDFCompanionHost.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.22000.469_none_3038532b4b83a565\f\wowreg32.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.22000.376_none_a359e3d81485694b\f\SenseCE.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.22000.469_none_cc9ed34da60ac9c4\f\Robocopy.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.22000.469_none_f7ee9eea6a40784c\UevTemplateConfigItemGenerator.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.22000.318_none_fbf48b4fce07c440\f\tcblaunch.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.22000.1_none_c58a6d6ead7a5610\rasdial.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runas_31bf3856ad364e35_10.0.22000.434_none_5b46b110e29f5b31\f\runas.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.22000.1_none_724d8db15095b32c\SpeechUXWiz.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.22000.1_none_35fb189c78bdb167\eventcreate.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.22000.1_none_430c6a5b816abeb9\hdwwiz.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.22000.282_none_6f399112972db672\f\MusNotificationUx.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.22000.1_none_38378aefc68a365f\autochk.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.22000.282_none_59d63580ebab6c4c\r\WpcTok.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.22000.376_none_fbeabbf57111df0a\r\vfpctrl.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.22000.282_none_c161005c63dc5d29\Windows.Media.BackgroundPlayback.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.22000.376_none_2d61a5193292e66c\f\audit.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.22000.194_none_4dda7ffaba1d5c31\f\cscript.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.22000.493_none_2b6ddb5beae8ce90\f\hvix64.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.22000.348_none_68edda92a96b8e44\r\conhost.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.22000.1_none_713e4e4444c3d34d\wmlaunch.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.22000.1_none_25381cfb8a14a984\wiaacmgr.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_10.0.22000.1_none_af37ae793d4cfdf0\xwizard.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.22000.1_none_cfdf17c0e1db180b\rasdial.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.22000.282_none_30a5190270148358\f\directxdatabaseupdater.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.22000.1_none_37833ea9df2deb57\scrnsave.scr- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.22000.1_none_76cebe5f6ad1251a\winrs.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wordpad_31bf3856ad364e35_10.0.22000.1_none_8e52c12ba60f5a2c\wordpad.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\bfsvc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\vbc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.22000.1_none_f27e3cf28c93be1a\UwfServicingSvc.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.22000.1_none_63773003e6efdaf0\MsSpellCheckingHost.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.22000.348_none_30982568e4ff2521\r\vmwp.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.22000.51_none_8fdc96dca7b0b006\f\SpeechRuntime.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.22000.1_none_bf1c03009ab5fa34\diskpart.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.22000.1_none_9033bf3e0d1a2461\SMSvcHost.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.22000.1_none_cdb916a4abddbb05\OpenWith.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.22000.1_none_6200919c299287d9\AppLaunch.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.22000.318_none_1e08617dd1895eb7\f\UtcDecoderHost.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.22000.1_none_d6935f7d69086fe5\DiskSnapshot.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.22000.1_none_dd4fd4f5b71d35a0\HvsiSettingsWorker.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.22000.100_none_b998a9a728d6401f\f\Narrator.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.22000.1_none_dc56eb74b96412e2\recover.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.22000.1_none_505e5b5dbc1f65d8\manage-bde.exe- 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_cabe784967f74f19e3e76504503554f8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njra.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.6MB
- SHA256 0d8f23219bcdfdbda14067fd8fc1f81e28ebd821da28ff713010d001df533474
- MD5 22ccad6959f3b902e4845e9fbbeabc3e
- SHA1 f02d3702d25d55f7aeafc632c048c7fde9326bdf
- SHA512 0abf39ada6dd5c6ca8ed81f860d47c305f53b8e926eb3076d855b4098f2eae1400f4d1c2bceabbfbee4f0d20ca871095710549732bd4122ffd382164887f1d20
- SSDEEP 98304:7fkZcNKUgTH2M2m9UMpu1QfLczqssnKSTjoh:zPDgTH2qBpu1QfLIqsuf3oh
- TLSH T11786E71165E98FACC05FD474CE4669A5AA237C468F209FDF0980BE293E766F05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH