Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/08/2026, 04:59
Behavioral task
behavioral1
Sample
2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 7.2MB
- Sample260803-fmjmdack9s
- SHA256 71429578d0e6e110bff06fe05836b422afc4c13e0d19305a4498e6bd7ed4f281
- MD5 893fe3a0a428cac33f77938eb3355e78
- SHA1 2e1ec4f18313f2725f97a0519efb39d0d4ef9b3b
- SHA512 c9f83c76156e66571237e9752ba75af1ffd3070400499941548ffa8adbd7afbd970399eb4a9f491a73db0267d2669b4a636419d030661fb8cfc36b158b7544ec
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqM:Z3qqUHxqPF4VMNP60joX0oAaYdxDm
- TLSH T16E761803F253899AD191D134C951C632D6313BAD47B344EFF96CB298EA3B6E36638B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cacls.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5448-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c54d-5.dat upx behavioral2/memory/5448-527-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5448-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\r\EduPrintProv.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\wksprt.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseImdsCollector.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1_none_c1bc4da0b901a509\ldifde.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\FileExplorer.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandbox.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\r\proquota.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_f817d499062c355e\makecab.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\tttracer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-utilman_31bf3856ad364e35_10.0.26100.1591_none_a8be556815a4e811\r\Utilman.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk_31bf3856ad364e35_10.0.26100.1_none_dee795aa2a4dbd74\autochk.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-eduprintprov_31bf3856ad364e35_10.0.26100.1150_none_4d28a605d2d4d62b\EduPrintProv.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-tools_31bf3856ad364e35_10.0.26100.1150_none_73e2ba5833894ee6\wbemtest.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAgentPolicyGenerator.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\r\NcsiUwpApp.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\finger.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5f97775aa22929cb\cacls.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\r\nmbind.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nt-enrollmenthelper_31bf3856ad364e35_10.0.26100.1591_none_d68a8e522d36701f\PinEnrollmentBroker.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_10165438a36843ef\CasPol.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_b17acfc36f0ec944\runonce.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\r\wksprt.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_4c51727a891ced07\r\credwiz.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_datasvcutil_b77a5c561934e089_4.0.15912.0_none_5cfe50bb9b6405ea\DataSvcUtil.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\msinfo32.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgrsvr.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\WSManHTTPConfig.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\explorer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.26100.1742_none_cbf6967615a0f1cb\r\hvax64.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\r\IMEPADSV.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\r\dialer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.26100.1591_none_717110db66a82f37\r\EDPCleanup.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\AssignedAccessLockApp.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.26100.1000_none_e9c96c85d0fddddd\r\mstsc.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPDCT.EXE- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.26100.1150_none_71ef838ad2cbc1c0\MDEServer.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1_none_08f675ddb6f77c4f\dvdplay.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deviceproperties_31bf3856ad364e35_10.0.26100.1_none_e73e0b63a2759f40\DeviceProperties.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\r\logman.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..-client-aggregators_31bf3856ad364e35_10.0.26100.1591_none_1057fc96a520e997\r\AggregatorHost.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDlpService.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_8fc81fd68823646b\ComSvcConfig.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.WindowsAppRuntime.CBS_8wekyb3d8bbwe\DeploymentAgent.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WindowsBackupClient.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\dwm.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iexpress_31bf3856ad364e35_11.0.26100.1150_none_441b414b1810724c\wextract.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.26100.1591_none_7fa09276a9a8ba6c\esentutl.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe- 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_893fe3a0a428cac33f77938eb3355e78_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.1MB
- SHA256 46e7a24856ed6347f285ff0b5fe5e23473c468043c109b2abe1ebea274c4b48a
- MD5 12c6d8226074a7ab53f07fa20e8b078d
- SHA1 aee276fa7592751303e01f6653ce74ccaca027cf
- SHA512 429f311563cd6082c73c894c1b7d1e197250a2cdfd6a60213000335e561568cbe9af3d17d02c6f4a74bb1a3181ce01e4a5af3c4c5a737827d0d827e3edd33989
- SSDEEP 98304:Z3qqUHxqPF4VMNP60joX0oAaYdxDvezSC6v2XMH+:ZaHxXMZ6+oEvdxIR
- TLSH T15F863803F253855AD1A1C134C992D632E6313BAD477344EFB95CB298FA3B6E36638B11
- MD5 SHA1 SHA512 SSDEEP TLSH