Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:45
Behavioral task
behavioral1
Sample
2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
- Size 8.8MB
- Sample260709-t9cdgaex4y
- SHA256 b823f0a59f3573ea238b843de0a7138321185b8c4e01e0eb6bb83f57faf02b5c
- MD5 a8a16af602f4273845b058d0b3512667
- SHA1 2ec11836dfcfd0ab34916c51b8044a53f670a305
- SHA512 4b9065b308ef6a515d8d4abb057a3cffe062826e10317313ebffa77403ba0504634e1affa8638dbaa217d33cffb4d928b359e8428c4190191c91943513740e2b
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKSX6G:vD1cISgTH2qBpu1QfLIqsufX6G
- TLSH T1FD96E62162D68FDCC05F9474CE0666A196637C458FB09FDB19807EA93E766E07E3820F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ddodiag.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\choice.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\curl.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\explorer.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\more.com- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\logman.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\runas.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SysWOW64\clip.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/5524-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x002600000001c471-5.dat upx behavioral2/memory/5524-470-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5524-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\AggregatorHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\wifitask.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\explorer.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-tool-exe_31bf3856ad364e35_10.0.26100.1_none_f70e66181fe2eced\manage-bde.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\taskhostw.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1_none_9e9d7dbf35638ca0\WMIC.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\uwfservicingscr.scr- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5f97775aa22929cb\cacls.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\uwfservicingscr.scr- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_5e31b7c284234e98\r\FilePicker.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1150_none_b60d35260c7b5db5\sdiagnhost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizardElev.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\wuaucltcore.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\charmap.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.26100.1150_none_71ef838ad2cbc1c0\r\MDEServer.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SecureAssessmentBrowser.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_5c657b87715a8e52\aspnet_regbrowsers.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\r\CheckNetIsolation.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\r\RecoveryDrive.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_wp.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_231fe8bbbb362efd\IEExec.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.26100.1_none_67309bf6fa5abf27\runas.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_4.0.15912.0_none_447f4612d8b724d2\AddInProcess32.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_bcd933e3a6b2aaa4\mscorsvw.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.26100.1150_none_e04b5db66660ee87\r\fontview.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.26100.1591_none_e5de07285a53f2d6\spaceman.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-service_31bf3856ad364e35_10.0.26100.1591_none_0065af33551e5c88\BdeUISrv.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-whoami_31bf3856ad364e35_10.0.26100.1_none_d5c4d1091ec38541\whoami.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\bdechangepin.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.26100.1_none_3dee2da03b86f50d\SystemPropertiesHardware.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\ttdinject.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\NETSTAT.EXE- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\rmttpmvscmgrsvr.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a8a16af602f4273845b058d0b3512667_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.7MB
- SHA256 83d30242d64cd95f91ecc389d1c70fe71ae67d45241b10f64623c26b69bc900b
- MD5 4cdae03d17fcb8ecd617b46f8abb07cd
- SHA1 24b268401b28f4af154cb25ba35b3d56071d9c86
- SHA512 6f09cb282aa8121942fd2c6c446a2a9842de3eb2d60dca4daf49d777c77c1d06bc518f359e28fe403f8069cc324a15e7a20e510b665f0c9082667051391736e7
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKSX6PezSC6v2XMHO:vD1cISgTH2qBpu1QfLIqsufX6Up
- TLSH T12EA6082161E58FA9C05FD074CE4666A1AA633C458FB09FDF1541BEA93E326E07E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH