Analysis
- max time kernel
150s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 06:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
- Size 4.9MB
- Sample260711-gsp7saez21
- SHA256 e6b0b87ad249d328e18561aa5b593c672c3f72d394ab1fa1384639e57c26bd04
- MD5 3f09934cbd77ebc1898c45e8c7528d4f
- SHA1 62699f238cd138564997b3bcc828c24ca20dde9b
- SHA512 af63fdc95a0a3160ef784ec5d1a7e604c43aa3c8d82bda3760f02914bb5ea1fc2561f40e98666ef96287fcf061c01bcd81ffb06c4ba85b06a5d48e0976d6ec02
- SSDEEP 98304:kl3RHMYTKXkcmrfJiyzY8zWDaDHiQ8QThojumat:sRsYOXkcWJiARoat
- TLSH T100368E29B6F901E5C073D1B8C9436756E6B2741507318ACB62949F2D2F3BEE59E3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\choice.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\more.com 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\psr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\curl.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\clip.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\takeown.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\tar.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dialer.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.26100.1150_none_48c9cd2bf27dfea7\nfsclnt.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_08e0c9d322babcde\r\OpenWith.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\containerworker.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1_none_f6992c40f1427a7d\mobsync.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-analog-facefodhandler_31bf3856ad364e35_10.0.26100.1591_none_461a2040b9fd2031\r\FaceFodUninstaller.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_9a5fa07ba58b88a8\DWWIN.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1150_none_714a211aef7dc47f\eventcreate.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.26100.1150_none_5c8523a823214933\wmprph.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_b8da79967c00e6a5\verclsid.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61c655cc264adc4b\ilasm.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.26100.1_none_e6fd26a1f7fbb233\comrepl.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1150_none_d0187a73d39a8bd8\IEChooser.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_6c61929e721b6ffa\fsquirt.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\r\osk.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\PrintQueueActionCenter.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\unsecapp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-ngen_exe_b03f5f7f11d50a3a_10.0.26100.1_none_d44f53dce9b09eb4\ngen.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_4e3bd09ff189ac9a\aspnet_wp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_752bfd0c9236819e\mscorsvw.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_b21add2e107e23b6\w3wp.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.26100.1_none_8c35e9ae895560fc\wkspbroker.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_496d6688fe6244d2\PickerHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\EDPCleanup.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-grpconv_31bf3856ad364e35_10.0.26100.1_none_9f7bcd3ea63a7384\grpconv.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1150_none_fb8846b4a7c2bad5\r\netsh.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\ApproveChildRequest.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1_none_eb822b3ce383f6d7\dialer.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\WUDFCompanionHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\r\UserAccountControlSettings.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.26100.1591_none_300773bc06dfa2f0\r\NarratorQuickStart.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\explorer.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthHost.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\oobeldr.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.26100.1301_none_6b46da31a1bd9a38\DmOmaCpMo.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.26100.1_none_2dd1356526e6ef59\format.com- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_networking-mpssvc-netsh_31bf3856ad364e35_10.0.26100.1591_none_55053aa4ab175950\CheckNetIsolation.exe- 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-11_3f09934cbd77ebc1898c45e8c7528d4f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1112
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv 3R2Fzp5djUe4rxXgrqyKmg.01⤵PID:3552
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.8MB
- SHA256 f126303b21e4d74335d51c4031705cd7b6d487d4d43b69b75b38952ef6b3337b
- MD5 1a0fabf5de94d0fa7a2d13722c30f42f
- SHA1 8a098cab1bc54b6a3a29846e6d58d87379200ba5
- SHA512 daed017f9657fa84bdd76aabdabda8de92c5419a5eed0af17a5b433171c78d768d0d111f81e7b2606423649a4e18ba4353c073a4c49b6e4d839d7df36f696ea2
- SSDEEP 98304:kl3RHMYTKXkcmrfJiyzY8zWDaDHiQ8QThojumaSezSC6v2XMHa:sRsYOXkcWJiARoaZJ
- TLSH T181566D29F6B842E6D073D0B8C9936756FA727445073089CB52959B2D2F37EE58E3A330
- MD5 SHA1 SHA512 SSDEEP TLSH