Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 22:09
Behavioral task
behavioral1
Sample
2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 5.8MB
- Sample260802-121jnasgra
- SHA256 13b05854a65de49f23441fd61400605b77097f88c9f279872a20329f5a5f7f46
- MD5 0896e73c95654d48d535bbc72287c60d
- SHA1 df31f9553854f8ae7787a900cb98355f86325a41
- SHA512 70d76c0cb46638facc96f82b3cc0b12953aadf5598130faa90c9c4da498394e7f3fb77f6e2ef0246e218d9cc330002414c2796a98b8e224873d3ae19779127c2
- SSDEEP 49152:4Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fWsw6dTPBK:GKUgTH2M2m9UMpu1QfLczqssnKSz
- TLSH T17756B41165DA9FDCC05FA474CE0669A16A237C868F61AFDF0980BE253E756B06F3810F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\auditpol.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\findstr.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/2456-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x0009000000016cdf-5.dat upx behavioral2/memory/2456-614-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2456-2909-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\EASPolicyManagerBrokerHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..msettings-datamodel_31bf3856ad364e35_10.0.26100.1591_none_85f1fbdaacd275e0\r\SystemSettingsBroker.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.26100.1_none_e1bbfdf0b2054cc5\iscsicli.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_d618b29150d63de2\colorcpl.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\ie4ushowIE.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_a73031e9ff1c7610\r\wmpshare.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_064f6097e94bbeed\powercfg.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-tracing_31bf3856ad364e35_10.0.26100.1_none_1f279d758fbcb0c0\msdtcvtr.bat- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\r\GameInputSvc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1150_none_858f29bf9f3816d2\mtstocom.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.26100.1591_none_bc6c19c8cde9cb50\SystemSettingsAdminFlows.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrshost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.26100.1150_none_68a5bbed8a1f4ed6\uwfmgr.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.26100.1591_none_4f9c89c5e078e421\r\plasrv.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.26100.1150_none_c8eda2cd3209b21d\hvc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.26100.1591_none_125fbf4d94a6971e\r\audiodg.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\proquota.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.26100.1_none_2d8ad328b5479b73\AddInProcess.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_ae4be759a24c5f51\odbcconf.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-calc_31bf3856ad364e35_10.0.26100.1_none_a6b1a99b83489282\calc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpksetup.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpCmdRun.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\regedit.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_dfsvc_b03f5f7f11d50a3a_4.0.15912.0_none_c2b647ba71508734\dfsvc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..frameworks-usermode_31bf3856ad364e35_10.0.26100.1591_none_38d18bb2a54a6d36\r\WUDFHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\r\wifitask.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\AppHostRegistrationVerifier.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\r\TCPSVCS.EXE- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15912.338_none_b6935413ba17b58c\csc.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\EaseOfAccessDialog.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.27000.360_none_a4b0965e18742ee0\aspnet_regbrowsers.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-legacyhwui_31bf3856ad364e35_10.0.26100.1_none_e9bc7515e52e45ce\hdwwiz.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.26100.1_none_705e51669f200004\powershell.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.26100.1_none_65fa7713b81f7fd0\aspnet_regbrowsers.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..resentationsettings_31bf3856ad364e35_10.0.26100.1150_none_090eab20b35405f2\r\PresentationSettings.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1_none_e42fc57779c55fcd\cmdkey.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.26100.1591_none_08d143c7d80566f8\windeploy.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.26100.1150_none_dbed5373b4208431\r\msfeedssync.exe- 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_0896e73c95654d48d535bbc72287c60d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.7MB
- SHA256 cb3b86a6b9611f5861784954d7be5b9bbe0ee2763764b0df046e152691912abf
- MD5 159c7f3a9a35f952c60eae96301f83d0
- SHA1 66bd76e5171eb60b7ba5b38314280ef8ae1fb5d9
- SHA512 28e53c16b5a70b8e8f14a1c70df5ee1f322cf921df2359502263314b40e0b3250fdc55994357f68c20eec1b7bca3a4ceb7d049e102b23b0a41d369dfd6b22866
- SSDEEP 98304:GKUgTH2M2m9UMpu1QfLczqssnKSoezSC6v2XMH6:WgTH2qBpu1QfLIqsuf/t
- TLSH T19166E61161D99FDCC05FD474CE4669A5AA237C468F20AFDF0980BE293E766B06E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH