Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 16:08
Behavioral task
behavioral1
Sample
2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 13.7MB
- Sample260801-tlkpyadc39
- SHA256 ce381474267305c83eabac589b4bcb85d1785f5d8787f6f837cd3f9f4fa11ce4
- MD5 a837a65506dd6647e3ad8b9a7e256296
- SHA1 537aa0aa7109675a7db4fc1cc88362990317797b
- SHA512 8fe37234ce323e162b4052d0dbb9edeba39a1317c2849311167aaa1b5f8a0b7410bd3e4cffb0493ca62ee0e831aee38cd7ff6f60691e6875af8aa4ed0fba471d
- SSDEEP 196608:Kg62PgTH2qBpu1QfLIqsufFgTH2qBpu1QfLIqsufH:aVTHNBpu1Qfc0iTHNBpu1Qfc0H
- TLSH T1DFE6D61161D99FDCC05FD474CE4665A5AA237C468F20AFDF0980BE293E766B06E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sudo.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winver.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/4656-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x001600000001c3b2-5.dat upx behavioral2/memory/4656-344-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/4656-2912-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECECEC7E-D0D4-455B-8F24-7676AF0A59FB}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingMasterScript.cmd- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\r\ldifde.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-computerdefaults_31bf3856ad364e35_10.0.26100.1_none_0dbef45e6036c735\ComputerDefaults.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\LaunchWinApp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.26100.1_none_2350f58e1a989738\etfsboot.com- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_b667649ed5836b0d\aspnet_regiis.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.26100.1150_none_96f4f35e249cde0c\wecutil.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1150_none_df24b599b0c88e62\prevhost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_5b0b14d6cc274cc8\csc.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_ff98a305e55fa64a\r\IMTCPROP.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ie-iechooser_31bf3856ad364e35_11.0.26100.1_none_c53f9dbf15451292\IEChooser.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandlinehelp_31bf3856ad364e35_10.0.26100.1_none_d11ede0471c43ced\help.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1150_none_f57fd51c6f680fbc\r\eudcedit.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nsimulation-service_31bf3856ad364e35_10.0.26100.1150_none_74a667b087b1ac17\PerceptionSimulationService.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_971a4fc44ce4ae24\XGpuEjectDialog.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\r\IMEWDBLD.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\FilePicker.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..pectedcodepathtasks_31bf3856ad364e35_10.0.26100.1591_none_99fc5c721ed12b35\r\UCConfigTask.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\WMIADAP.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\sdbinst.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\splwow64.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\uwfux.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_wp_exe_b03f5f7f11d50a3a_10.0.27000.313_none_a7d95898a02bb485\aspnet_wp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\OpenWith.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\r\ClipUp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_ae4be759a24c5f51\odbcconf.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\r\CertEnrollCtrl.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1_none_c574d8b0f950d6dd\ImagingDevices.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1_none_c92eac93299dda10\chkdsk.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\rdrleakdiag.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsuseragent_31bf3856ad364e35_10.0.26100.1150_none_fcc2db11075b9319\r\WmsUserAgent.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.26100.1591_none_1fa6e4d8d638e827\UserOOBEBroker.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.26100.1150_none_ad5d9bcb00930036\newdev.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmdl32.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1150_none_48349abe916de6bd\PasswordOnWakeSettingFlyout.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\Core\ScreenClippingHost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-c..plus-setup-migregdb_31bf3856ad364e35_10.0.26100.1_none_3498f416009e0fc9\MigRegDB.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe- 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_a837a65506dd6647e3ad8b9a7e256296_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 14.6MB
- SHA256 a818c97c9fa62c704e11c9f10e6bca878757058bec8f287cc15b15947b4dfebc
- MD5 c732748d32adb5ce6346a47a935632d0
- SHA1 3454672ca926e73ff9807fd675dad1f094efb506
- SHA512 912a509155396e1ed4e6141eac8f3990c046268958e769b87dc522734db48b0901fc6bee567ab4134f1801665e508b6ef735a4bc6361f956e5197e16eefc8424
- SSDEEP 196608:Kg62PgTH2qBpu1QfLIqsufFgTH2qBpu1QfLIqsufjj:aVTHNBpu1Qfc0iTHNBpu1Qfc0P
- TLSH T194F6E61162D99F9CC05FD474CE4669A5AA237C468F209FDF0980BE293E766F05E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH