Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/07/2026, 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
- Size 4.9MB
- Sample260711-gsp7saez21
- SHA256 e6b0b87ad249d328e18561aa5b593c672c3f72d394ab1fa1384639e57c26bd04
- MD5 3f09934cbd77ebc1898c45e8c7528d4f
- SHA1 62699f238cd138564997b3bcc828c24ca20dde9b
- SHA512 af63fdc95a0a3160ef784ec5d1a7e604c43aa3c8d82bda3760f02914bb5ea1fc2561f40e98666ef96287fcf061c01bcd81ffb06c4ba85b06a5d48e0976d6ec02
- SSDEEP 98304:kl3RHMYTKXkcmrfJiyzY8zWDaDHiQ8QThojumat:sRsYOXkcWJiARoat
- TLSH T100368E29B6F901E5C073D1B8C9436756E6B2741507318ACB62949F2D2F3BEE59E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\more.com- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\chcp.com 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\psr.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\systray.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\autofmt.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\printui.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.19041.1266_none_aa0661cc14f9fe9a\r\vmwp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\wsl.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\SysResetErr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_c5675ea732c2eaa0\LockApp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6012c8cabf808ff7\f\pcaui.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_b4441130315b5f1f\mmgaserver.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.19041.1_none_87e54edbaf62ca00\repair-bde.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.19041.1288_none_23aa03725ec9354a\r\wuauclt.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1288_none_4b1349ab76b8812f\splwow64.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\r\sppsvc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCPROP.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-utilman_31bf3856ad364e35_10.0.19041.1_none_b89abd72d09ad54d\Utilman.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.867_none_b4e9fc09cfcbdd7c\AxInstUI.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\f\wslconfig.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskkill_31bf3856ad364e35_10.0.19041.1_none_db6f0c88fb6e127a\taskkill.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_e304dcaa2490f61c\f\SystemUWPLauncher.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\UevTemplateConfigItemGenerator.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.19041.1151_none_fbdc4c5f677dc2ec\f\HvsiSettingsWorker.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_40b989c5d3ea9316\r\sethc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.19041.153_none_6ef8a222ac00dbc2\r\TrustedInstaller.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..teelevatedinstaller_31bf3856ad364e35_10.0.19041.1_none_3b7fdf76aa8cfd53\WindowsUpdateElevatedInstaller.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.19041.1_none_7a53549f2797bc70\nmscrub.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\wininit.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.19041.1_none_bc67af2f62a6f130\ComputerDefaults.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\CallingShellApp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.19041.746_none_a5751a882524bee1\r\Defrag.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\r\AuthHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.19041.1_none_f4898caed6e558be\tzutil.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_e4e5027bf1e82209\f\WerFaultSecure.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmplayer.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_wpf-xamlviewer_31bf3856ad364e35_10.0.19041.1_none_0bff5a051c4a690a\XamlViewer_v0300.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.19041.1_none_159203c1973658cd\netsh.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.19041.264_none_02eb5d2ec5a9ec02\r\sdclt.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.117_none_7879d5035b0edfac\f\nltest.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_291e1d3069ab2f3a\diskpart.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.264_none_920963acedc8777d\f\fontdrvhost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_e9349b06dfab6fdc\r\imjpuexc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_d9e841974c1d46e8\r\setupugc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.804_none_8b46258bdefa0beb\r\FXSSVC.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fontview_31bf3856ad364e35_10.0.19041.1_none_fa551ac355d48c7f\fontview.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.906_none_ef0e010d1381269b\f\aspnetca.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\f\EASPolicyManagerBrokerHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.19041.746_none_72f50b15ab3c2aeb\r\ProximityUxHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_20dbe0239a0c22b4\vdsldr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.84_none_b4499a04dddcc22e\ssh-keygen.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.4MB
- SHA256 9f866edc742db50492b7a1d48a91550ebdf77957eb426cafddb1515c32cad515
- MD5 6289697646aa1e7c845b4e3c004da956
- SHA1 7b2bfb4724af5fe4a35b582780a9c96b9046583e
- SHA512 ffa5201a2cd9d486f8b933bd83a9706993efdfbf8935e3c0c39bb0557e07613b72c2cfbf0ececcc86c3f95484e846d6b3a3fcf6b4e180bae5a816de1cf05a16c
- SSDEEP 98304:kl3RHMYTKXkcmrfJiyzY8zWDaDHiQ8QThojumaJjoP:sRsYOXkcWJiARoa9oP
- TLSH T143467E29F6B842E5D073D0B8C9836756E672744507308ACB52959B6D2F3BEE58E3E330
- MD5 SHA1 SHA512 SSDEEP TLSH