Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 22:12
Behavioral task
behavioral1
Sample
2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 5.0MB
- Sample260802-14sltsge52
- SHA256 21b5a4623bc9f6464d029771adaa3f8b801b2781ff0153bf1608ca2a3f80f6eb
- MD5 02429205aeb073dadfe8f0b256ccc65e
- SHA1 fe1060916e51f31388703a0530e51bf70ae24178
- SHA512 f241ccffd3a1f8854dd3c151711363c8f776e542bd5e646c96ddef3cb4bf2892230f077bd709838775be4f3883638d18cb9d3744cd9901871dfc06efad5180c9
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqI:Z3qqUHxqPF4VMNP6TJ
- TLSH T14F36B643F213894BD295DA34C819957192253FBD87B345BFFC6CB288F63B1A36928E11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sxstrace.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfmon.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/3264-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c49e-5.dat upx behavioral2/memory/3264-741-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3264-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-ftp_31bf3856ad364e35_10.0.26100.1301_none_530ca0a73ce97b04\ftp.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\UUS\amd64\MoUsoCoreWorker.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\r\WpcTok.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.26100.1591_none_e5de07285a53f2d6\spaceman.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_b60058d9621fad85\wscadminui.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_139e8f2156be3ffe\regini.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.26100.1742_none_292a3be8c3034786\r\VmComputeAgent.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-i..sermode-kernel-la57_31bf3856ad364e35_10.0.26100.1742_none_8687939627e21dcf\securekernella57.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsmgmt_31bf3856ad364e35_10.0.26100.1150_none_e6bdbe4daedb7df6\r\dsmgmt.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_95cced994cad782c\BackgroundTransferHost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\tracerpt.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\r\vmcompute.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\MicrosoftEdgeDevTools.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\rmttpmvscmgrsvr.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_10.0.26100.1150_none_686748f1a08de9d9\r\wiawow64.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\WmsSelfHealingSvc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1_none_3c32e2b773856e68\dllhost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ne-plugins-wireless_31bf3856ad364e35_10.0.26100.1591_none_b99784523fc95a77\BypassNRO.cmd- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.26100.1591_none_2bcc571573c94745\IMESEARCH.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.26100.1591_none_09563e96d43be8d8\r\conhost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttune_31bf3856ad364e35_10.0.26100.1_none_b07834d22711b2d0\cttune.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.26100.1591_none_86d079db2c05e448\r\ResetEngine.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-upnpdevicehost_31bf3856ad364e35_10.0.26100.1591_none_5da82f9be48ad513\r\upnpcont.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\r\bfsvc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\r\BioIso.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-takeown_31bf3856ad364e35_10.0.26100.1_none_f6df0e2a7e2ab480\takeown.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.26100.1591_none_087ed6682bae0fd0\wifitask.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_state_exe_b03f5f7f11d50a3a_4.0.15912.0_none_61e02e661eddd7ec\aspnet_state.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_b9a1cc1fee60a882\mountvol.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PING.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.26100.1_none_a2b84bade0a375ce\csc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_e0a0e7a383989b03\IMEPADSV.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\DWWIN.EXE- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_b62f80cd4eabea24\SecEdit.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\mmc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\appcmd.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\HelpPane.exe 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\splwow64.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\r\WaaSMedicAgent.exe- 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_02429205aeb073dadfe8f0b256ccc65e_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 5.9MB
- SHA256 4a3783355215883b2ee614d7b1cea04f318d6087e919d019106229213447f22d
- MD5 bb6132afceb4abf39cc8106b30529928
- SHA1 15747b07d866d92e9f859b942d71be282e80a9e9
- SHA512 d9c53c80eaf111e97a02aa0c3ed66198936ff41f80f346cbedac832bdd1471749bced71354b1b08eaf7ad3c9733c8e293345435377d1663ae7b86431f1b306b5
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqG:Z3qqUHxqPF4VMNP6TmezSC6v2XMHy
- TLSH T14456F742F223C94BD191D534C8599571A2213BAD87B345FFFD6CB288FA3B1A36928F11
- MD5 SHA1 SHA512 SSDEEP TLSH