Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 09:22
Behavioral task
behavioral1
Sample
2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 6.5MB
- Sample260629-lcbfxaby4m
- SHA256 7194d155b4329dc0499cb02812bc9a661f955f2bd65c2ca65234ecd35b854d8c
- MD5 201f3980086838216c478f8c34d0ed4b
- SHA1 d7160dccdb82298bd3bc70e5eb72f369a37094f4
- SHA512 de47a849a847be84d4d1670b94e6c23e31ffbd766482dbf5a3f67ca34d0994a82272761ceff554987f4d506b9299b874eee545e879a974e1a3d3f1fb8eae3a9d
- SSDEEP 49152:9TAnlPv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6m:9TAnBKUgTH2M2m9UMpu1QfLczqssnKSX
- TLSH T18766C419A9DA9FDCC05F9434CE0667A966237C458F206FDF09807E25BA75FA06E3810F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hh.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net1.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/1904-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000300000001b2e4-5.dat upx behavioral2/memory/1904-587-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/1904-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1_none_2154eeee51c5b168\mcbuilder.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.26100.1_none_45fe1c64c43dedc8\GamePanel.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..executionprevention_31bf3856ad364e35_10.0.26100.1_none_c6d712038d260ae7\SystemPropertiesDataExecutionPrevention.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\powershell_ise.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_db09ff29aaa57394\wowreg32.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-bootsectortool_31bf3856ad364e35_10.0.26100.1150_none_a875b50b457475fd\bootsect.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\cleanmgr.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\fontdrvhost.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\LanguageComponentsInstallerComHandler.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1150_none_8727dcae71f2c0a2\r\logagent.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.26100.1_none_1ae648617b7c1208\NisSrv.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\XGpuEjectDialog.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_29b9b764bd0322b9\UserAccountControlSettings.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVShNotify.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\credwiz.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.26100.1_none_1c735df6df567cc4\RemotePosWorker.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..diagnostic-schedule_31bf3856ad364e35_10.0.26100.1_none_90ca449ce2441ece\MdSched.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\r\RdpSaProxy.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\TiFileFetcher.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_42528c82d31b82f1\cvtres.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\rdpinit.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.26100.1_none_2152e7eb342c1e53\TsWpfWrp.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\lodctr.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\TokenBrokerCookies.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\sfc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1_none_e06e3d007fa29525\dsdbutil.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\r\vmcompute.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\r\bfsvc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmdiag.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\r\BootExpCfg.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_d6930f2587043445\vbc.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\r\la57setup.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrm.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\r\BrowserCore.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\NETSTAT.EXE- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_201f3980086838216c478f8c34d0ed4b_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.4MB
- SHA256 aa114855587f31647bb134b0379b4507d3f1cd0139b73f2b8fe7e94ce6445341
- MD5 11c9dd09bbf4e1a89c080dd6aecc26b5
- SHA1 139709317285bc6d45b648078861d858fcb6c6b8
- SHA512 1c0c46edcc307b296364075f80e218818e701da861f0b860349f209fcd7f3a83836f699eb383fc540f0ef71e369ec2cc022b2681b1a301174f56387a52fe7218
- SSDEEP 98304:9TAnBKUgTH2M2m9UMpu1QfLczqssnKSEezSC6v2XMHX:9TAngTH2qBpu1QfLIqsufTc
- TLSH T14276E619A9998F9CC05FD474CD4667A969237C458F206FDF0980BE28BE36FA05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH