Analysis
- max time kernel
150s - max time network
156s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:50
Behavioral task
behavioral1
Sample
2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 8.4MB
- Sample260802-vb8vfsxbkg
- SHA256 4bab5e640a5c35d08659c2527f534862c989e35eb6eddc11305786d1061686a3
- MD5 cb1755034463828b65b0030fd0a5d6d1
- SHA1 efa5382019885ac2830aef647c200506605d212a
- SHA512 91db4b46bcffd6d20d114c79cb3bf877a08ce68c38e240eb4b1310f01a37c1a7b12735751c4f0275ec69371476730b8462caf6af0591f646fc74a8fda227678a
- SSDEEP 98304:Z3qqUHxqPF4VMNFjouLapIufkZc1fkZc4Wi:ZaHxXM/oucI4PxP4Wi
- TLSH T1C9963912F2638656D0A5C030CE529621E6713F6947F385EBB91CB2DCAE3B6E37538B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\subst.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\edpnotify.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/1780-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c518-5.dat upx behavioral2/memory/1780-413-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/1780-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3776D576-0A64-4D44-BF96-63E8D160091B}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\r\aspnetca.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\lodctr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.26100.1591_none_e2b02f289d06cfcc\IMEWDBLD.EXE- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.26100.1150_none_e04006fcf72e00e6\ShellLauncherConfig.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_68cde88f2c470738\netiougc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_9dcb4fe8bf21aec2\RegAsm.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-shellappruntime_31bf3856ad364e35_10.0.26100.1591_none_ae6cc2a1ab3ee224\r\ShellAppRuntime.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\find.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIdentity.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-omadmclient_31bf3856ad364e35_10.0.26100.1591_none_ef5fd1803186a7fb\r\omadmclient.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_7c2eaa615e99e234\r\IMCCPHR.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\sdchange.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1150_none_858f29bf9f3816d2\mtstocom.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_smsvchost_b03f5f7f11d50a3a_4.0.15912.0_none_6f42c7c83cc3cb06\SMSvcHost.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1_none_c2022b2202ac5e56\RdpSaUacHelper.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.26100.1_none_0142444d3857c993\dplaysvr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.26100.1591_none_6415f1d934c35258\hh.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\OptionalFeatures.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\UpgradeResultsUI.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1_none_eb822b3ce383f6d7\dialer.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchProtocolHost.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-core_31bf3856ad364e35_10.0.26100.1591_none_53ec4fcd7ac99448\r\Core\LogonWebHostProduct.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmproxyd.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ectionflow.appxmain_31bf3856ad364e35_10.0.26100.1150_none_c8dd030624b7f968\OOBENetworkConnectionFlow.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.26100.1591_none_a6992e1af01c7fb5\r\SppExtComObj.Exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.26100.1_none_d2c8c6a3035feb05\nslookup.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\bfsvc.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_b62f80cd4eabea24\SecEdit.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\rundll32.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.26100.1_none_f74329f6bb45918a\cttunesvr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.26100.1591_none_07d88b48de1d8831\r\HelpPane.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\r\ieinstal.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..odeupdate-servicing_31bf3856ad364e35_10.0.26100.1_none_a07bad500e90d9fe\ucsvc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\r\PinEnrollmentBroker.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_jsc_b03f5f7f11d50a3a_4.0.15912.0_none_2e8b40428114406d\jsc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1_none_f0f02bfb8c3b8acf\mtstocom.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_08d4e4725982e790\sethc.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe- 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_cb1755034463828b65b0030fd0a5d6d1_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.3MB
- SHA256 6c1c2289a8e2aca52b6cb29770ea0f7e8da47c5711b08fc7bb4e22480918a17e
- MD5 74599ece85fe24360b4ce15ded322ce0
- SHA1 5af35115f6fcd1a846c800bdb113638a1578d7c8
- SHA512 4f8b2fe8ac6cde0256132c67dafdedae55648fbc3fb4d4fb2db38ae4f02937ea54979ef729f14ab4a381f894460de469ec8f611218cf83dffaaa119a72180df6
- SSDEEP 98304:Z3qqUHxqPF4VMNFjouLapIufkZc1fkZc4WTezSC6v2XMH5:ZaHxXM/oucI4PxP4WAq
- TLSH T1F9A64A12F2638617D0A1C034CA929625E6713F6947F385EBB50CB2DCAE3B6E37539B11
- MD5 SHA1 SHA512 SSDEEP TLSH