Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 12:33
Behavioral task
behavioral1
Sample
2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
- Size 9.2MB
- Sample260709-pq7caaav2r
- SHA256 b2f65e69a61d77fbbca7f56d00d93b84f0e099436ca462f5346f71f5a9f922ef
- MD5 a0e331bc7a56250297b5f8b86c2d0360
- SHA1 836b61fc009f23ab6dee80c6fd8fa73482b77299
- SHA512 9ac513dd5427bf4950c03d024fa45d99c57aa359f12697301d664a420169793b529e0fb5f684aacda6c6817a192062c813a692dea069caaede751e52050b7f72
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKSPfkZcv:vD1cISgTH2qBpu1QfLIqsufnPv
- TLSH T14EA6F72261E68FD8C05FD474CE4666A1A6633C458FB09FDB15407EA93E366E07E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\reg.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\setx.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ftp.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\print.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\msra.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\label.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/3180-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000a0000000007a0-5.dat upx behavioral2/memory/3180-443-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3180-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\comp.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\nfsadmin.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\sdchange.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ostic-user-resolver_31bf3856ad364e35_10.0.26100.1_none_c228ad766e3b968c\DFDWiz.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\r\MDMAgent.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\TCPSVCS.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\wsmprovhost.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\notepad.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regsvr32_31bf3856ad364e35_10.0.26100.1150_none_143e6dc7df6d80b5\regsvr32.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpconfig.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\RestartAgent.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\VmComputeAgent.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\mode.com- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\r\PkgMgr.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\ApplySettingsTemplateCatalog.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.26100.1591_none_685b4f9deb1e8307\dstokenclean.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1_none_50fd5fe72912c2cf\Fondue.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-ksetup_31bf3856ad364e35_10.0.26100.1150_none_b8541704fe1248c2\ksetup.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.26100.1591_none_cdec79755d491fdb\Setup.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.26100.1150_none_15f982365a9d2243\r\UIMgrBroker.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1_none_e271ed51a0d2c02e\extrac32.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\r\ManagedWindowsVM.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiFileFetcher.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\r\hvc.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\wmpconfig.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-platform_31bf3856ad364e35_10.0.26100.1150_none_066fd0a833dca900\r\provlaunch.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_98d146a6029264ee\vbc.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_hyperv-ux-ui-vmcreate_31bf3856ad364e35_10.0.26100.1591_none_73076b811b15bddd\r\VMCreate.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\CheckNetIsolation.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\hh.exe 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\r\IEChooser.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_752bfd0c9236819e\mscorsvw.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c6c9a6c536b87ee9\mscorsvw.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\r\lpremove.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\ScreenClippingHost.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\RestartAgent.exe- 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a0e331bc7a56250297b5f8b86c2d0360_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.1MB
- SHA256 0e8d2c78000fdfda10513e844986336875616688a86ce3c762fb6f55e3302631
- MD5 62d5f872175425d353a1daec87e19f9b
- SHA1 77883bd9aa6a93fc08277f3ec992d8a3cbb07aee
- SHA512 f6004e844d32d7a97ced1978ac0f5ad64ab371e483e687a4de1b4b546d99f802e208e0c0fae02963c2f2734451cf36def1082335686ee3ea09449dd83521ac30
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKSPfkZcsezSC6v2XMHW:vD1cISgTH2qBpu1QfLIqsufnPrF
- TLSH T144B6082161E98FA9C05FD074CE4666A5AA633C458FB09FDF1540BE693E326E07E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH