Analysis
- max time kernel
150s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 22:20
Behavioral task
behavioral1
Sample
2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 8.4MB
- Sample260801-19lepsywhv
- SHA256 3f3cd47c6e6c5d5f5288c708cdf9b6e1d8b19674db8128e1b45cd50737fe5403
- MD5 0e80b56c2c54800db2e1459a7816728c
- SHA1 07d6b4e6f9238bf635b6d93d060c9d249f73e50a
- SHA512 2296e67d430d15797213e5788472a252761eb9357058c2da228a3ce401bcc9e6016bbea57d52f95598084341482d83fd67a652d3b115da9faad9b387ca62285d
- SSDEEP 98304:rXsRXg62ZKUgTH2M2m9UMpu1QfLczqssnKS1dS:Kg62PgTH2qBpu1QfLIqsuf1dS
- TLSH T10396F71162D99FECC06FD474CE4665A5AA237C458F209FDF0980BE293E766E05E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdchange.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\curl.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\attrib.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/3036-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c514-5.dat upx behavioral2/memory/3036-518-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/3036-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\logman.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.26100.1_none_4db4eeca2cb94664\IEExec.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\r\SearchProtocolHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6e6a9c2b69241453\hh.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmimageworker.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.26100.1150_none_8c544950ed549bc8\ThumbnailExtractionHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp_31bf3856ad364e35_10.0.26100.1742_none_d0e5d15b0fe45285\vmwp.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_4483428c4f7fb3a1\SensorRuntimeBroker.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snmp-trap-service_31bf3856ad364e35_10.0.26100.1_none_cc7ea73da7f4750d\snmptrap.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\prproc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-csharp_31bf3856ad364e35_10.0.26100.1_none_141f576a7cb67351\csc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\Taskmgr.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\relog.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\r\UNPUXHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\r\unlodctr.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\TRACERT.EXE- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\ScreenClippingHost.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-networkux-legacyux_31bf3856ad364e35_10.0.26100.1591_none_b94392693d48770c\r\LegacyNetUXHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_7da6e7654a833d6c\PeopleExperienceHost.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\ApproveChildRequest.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\Taskmgr.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appidcore_31bf3856ad364e35_10.0.26100.1591_none_d4e57f099acc84e0\appidtel.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\iisreset.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\HelpPane.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\r\SpeechRuntime.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1_none_5c6bc2527a7626ca\forfiles.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1_none_b3067605b67046e6\sort.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_wsatconfig_b03f5f7f11d50a3a_4.0.15912.0_none_65c6ab619fd35783\WsatConfig.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmpshare.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\r\sfc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_70cfc556f1a01eb7\r\CredentialUIBroker.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..acyinkingcomponents_31bf3856ad364e35_10.0.26100.1_none_493a1e7e2682a5b1\pipanel.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-cmdline_31bf3856ad364e35_10.0.26100.1150_none_63632032763f629f\Defrag.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\r\win32calc.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\r\DisplaySwitch.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\r\mobsync.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_c05a936cf44f86b0\choice.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_ec5dcd352cf057e6\aspnet_regbrowsers.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_regsvcs_b03f5f7f11d50a3a_4.0.15912.0_none_8ec56a4c64c63b5b\RegSvcs.exe- 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0e80b56c2c54800db2e1459a7816728c_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.4MB
- SHA256 865261deb523858c8aaff38dbd3096c8bf187a6ad6a1ff2d01749cdca678d1f5
- MD5 af7a0da1d2533804d0f3c031c8789790
- SHA1 71ed21ffee428ab28eed44dbfe150db7ee736128
- SHA512 7dbae44594238a07e3f0b35c508798db78783339a6de2e6122e314d3982455a1e323c7c9bb7ef1dc48ff74d26cea52e481bc8df7f2b1a96c853da955dd2b1aa2
- SSDEEP 98304:rXsRXg62ZKUgTH2M2m9UMpu1QfLczqssnKS1dDezSC6v2XMHG:Kg62PgTH2qBpu1QfLIqsuf1dQN
- TLSH T11EA6081162E98FA9C06FD474CD4666A5AA333C468F209FDF0581BE293E366E05E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH