Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 5.8MB
- Sample260802-w2mwcaek6x
- SHA256 83cfa70f77a6ca9e8467710b145d7b6f6c2514c9c291bb221bab2afe821461ac
- MD5 5eb556ee303968c58081762d7f829608
- SHA1 f404a6abc8df09bd2a29cf88d1d448680e62da53
- SHA512 b4021c94e8b73f4162bc995b3adedc8751a659b5b63e0a21178cd9f5235411e1241bdad735275ab549c9707074298ca6ad7296dfdd8e4b7bc64075401b0b3a1b
- SSDEEP 49152:kdJDp5AVBXdct+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyZPv94AEsKV:kTzodN0oAaldmdmnp1KUgTH2W
- TLSH T1DF562A13A54A24ACD15AD074DF5B8526AB207C8A07F5B4FF2284B6F13E76AF43F38605
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmmon32.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SyncHost.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\taskkill.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\r\imjpuexc.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\tree.com- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\Fondue.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\r\LaunchTM.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\WorkFolders.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.26100.1150_none_51b04101eb60b5d4\omadmprc.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_470d3c75c9c68669\r\fixmapi.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsvworker.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.26100.1591_none_a08d59ccf9531fab\icsunattend.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1_none_1093cc6b1440f8d9\RMActivate_ssp.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\r\GameInputSvc.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\ChsIME.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..estartup-change-pin_31bf3856ad364e35_10.0.26100.1150_none_8d8407dd0453280e\r\bdechangepin.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9ce862b2367e1d00\AppResolverUX.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..nstaller-comhandler_31bf3856ad364e35_10.0.26100.1150_none_bd2d71d23a70b85d\r\LanguageComponentsInstallerComHandler.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smartscreen_31bf3856ad364e35_10.0.26100.1150_none_59491cddd00c2dba\smartscreen.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1_none_fc5f223b9b5c3cc5\RMActivate_ssp_isv.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.26100.1_none_b667649ed5836b0d\aspnet_regiis.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_6b60aaf7ce5c0f38\r\AtBroker.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.26100.1_none_c492cc5e99915bfb\CastSrv.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\hh.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\r\ChsIME.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\diskusage.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_1.0.26100.1_none_6e96156553a511df\dplaysvr.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\phoneactivate.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\cleanmgr.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_ddaf5dc661e91ea5\aspnet_state.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\DeploymentAgent.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_1fb74192d4a9efd6\InstallUtil.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\r\IMCCPHR.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1_none_6259f5b61a4fa510\rdrleakdiag.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\r\PrintQueueActionCenter.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\Robocopy.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\r\AgentService.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_7d29102b8cab36a5\RmClient.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_10.0.26100.1591_none_dad8c095acaa16b9\r\services.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUxStub.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tasklist_31bf3856ad364e35_10.0.26100.1_none_2536da91c2de3f14\tasklist.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\mighost.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.26100.1591_none_a93e455bb3388085\r\msoobe.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\proquota.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_8b784347184cb631\BackgroundTransferHost.exe- 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5eb556ee303968c58081762d7f829608_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5408
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.7MB
- SHA256 06f17c545bfafa1db04205983258d360306518a9da4ea047c2cc5e41437ae578
- MD5 26b6572b548535e1eca8749947dd18f8
- SHA1 091cbdb0dc3ffc18b05a005f3e068507ae79d570
- SHA512 88b39f798c4738f304f7cef7dc717d64e2cae41df0c0cf70c61e40b2eac91ac9f1fed8c0b76c0fd69173b2fbcce65c10c0f6dfa195c90705ba597283af72a511
- SSDEEP 98304:kTzodN0oAaldmdmnp1KUgTH2fezSC6v2XMHv:PdCKmd0ZgTH2EU
- TLSH T1D6664A13A55915ACD15AD078CB4B9926AF303C8A07B0A8FF1285B6F13E76AF43F38715
- MD5 SHA1 SHA512 SSDEEP TLSH