Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/07/2026, 03:51
Behavioral task
behavioral1
Sample
2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
- Size 8.2MB
- Sample260721-eespmsd18k
- SHA256 c9ded66300f3ca0bbe76af0d17d5108962c1c115fa6af281feb5c252ba5ecb90
- MD5 c7db909c03e245b257a43c43e96d0787
- SHA1 1bba8354da93906051e39bf9c60145b58e3b5379
- SHA512 e471a2bc39bd8d65a185bc0bd4adca891471492e8cd705abc862721b91a8612d3f253a20f3635a6ed5eda43592120a63bbe195097b8ff6b35c66ae295083ec48
- SSDEEP 49152:esrxCakOElMaFLkC2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMmepI9g4pn0ekPb:es9Cak7PUbYZfgs0QXjo1
- TLSH T158863882BE9486EEDCB981705599D933EDB03D493932460BA380FB6F3E339616E54331
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\diskusage.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\print.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe -
resource yara_rule behavioral2/memory/3180-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c526-5.dat upx behavioral2/memory/3180-518-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3180-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\r\GenValObj.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5f97775aa22929cb\cacls.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1_none_02c44855de8e9d74\ExtExport.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6157b26c767f49a2\tttracer.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_8feeb08b8bdf7ddb\regedt32.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.26100.1_none_b8da79967c00e6a5\verclsid.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\ROUTE.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\r\SndVol.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\hh.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.26100.1150_none_68a5bbed8a1f4ed6\r\uwfmgr.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkping-setup_31bf3856ad364e35_10.0.26100.1150_none_544768fb4cb870ae\r\NDKPing.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_10.0.26100.1_none_4b983a10daa468ad\odbcad32.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wabmig.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_57dbe416963fa154\ilasm.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchIndexer.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.26100.1_none_ae9fddaa60638ed8\PresentationFontCache.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchFilterHost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\r\CredentialUIBroker.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\r\XGpuEjectDialog.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\pnputil.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\changepk.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\r\BootExpCfg.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIR.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1_none_7020b80d32da4344\diskpart.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\UevAppMonitor.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\eshell.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\ieUnatt.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\pcaui.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_f1eb80676c3fbe87\eventvwr.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-capturepicker.appxmain_31bf3856ad364e35_10.0.26100.1591_none_d07e775d9a3de1d6\CapturePicker.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_a661f954ca482f71\r\Win32WebViewHost.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.26100.1591_none_dea5c51b861cb734\r\powershell_ise.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\sfc.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.26100.1591_none_356e88b34c16567d\r\MDMAppInstaller.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_e4284e3cb060c8bf\r\wscript.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-keygen.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseNdr.exe- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_c7db909c03e245b257a43c43e96d0787_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.1MB
- SHA256 a00a7ed6eaef37c0ef00870d016fdda54140e0c792fb64a88a7e2c39735bfb80
- MD5 9220e05d7d5d2d4f4cba1947d23c623f
- SHA1 d8891b8a2acc8b4662b938085ba11efe2b75394d
- SHA512 4e6f17878145a43ba48556a91af186064da688cc8088d78663afc595a24e743cbf6ecfe4937fc1fe59a84ce760e9d23ec01a8b526b00920b2c9498b8591196f8
- SSDEEP 49152:esrxCakOElMaFLkC2mSdbDUAsHpD+bsxctZE+OM2EsT/HBJJdMmepI9g4pn0ekPA:es9Cak7PUbYZfgs0QXjoKezSC6v2XMHv
- TLSH T16AA64A82BE6486EEDCB981708596D933ED713C493A31464BA341FB6F3E339616E64331
- MD5 SHA1 SHA512 SSDEEP TLSH