Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 13:21
Behavioral task
behavioral1
Sample
2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 12.1MB
- Sample260804-ql1jlsfn4v
- SHA256 d2bffaf199a80a0663c6fd74caabe37dcc4f9c7e7af7a76071902e9e422d2b25
- MD5 fe2ee4cf09ac9f60a53703178996ee14
- SHA1 3e0db1f710dfdf3d3a60c3a2c444b7b16fd77ec3
- SHA512 0d6b26f6af9edeaf1d4b381aaabac2ca1b0571b92325bfa6fa6db5d53a5cc8ce2d19b41b334c91940105067fa1b5ea614a1f3cba6e877252e8d3de539f153bdf
- SSDEEP 196608:MgTH2qBpu1QfLIqsu4ouDXSgTH2qBpu1QfLIqsufI:HTHNBpu1QfckMRTHNBpu1Qfc0I
- TLSH T1CED62A12659A5EACC05FD474CE465965AA327C864F20AFEF0580BE353E766F06F3820F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mmc.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\net1.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\help.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c431-5.dat upx behavioral2/memory/4528-341-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/4528-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_810636a52f615c2d\r\psr.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_92ec6994d7abdee6\PkgMgr.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\r\CredDialogHost.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_c8691d618eec1ae9\CasPol.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\r\imjpuexc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\csvde.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d5c425d4ba6a5f\r\AssignedAccessLockApp.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tx-dxgiadaptercache_31bf3856ad364e35_10.0.26100.1591_none_435b2733e13c4689\dxgiadaptercache.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..nframework-pairtool_31bf3856ad364e35_10.0.26100.1150_none_ae401f21d0cb1063\r\pairtool.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1150_none_71cd60532ab93f47\TSTheme.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-vb_compiler_b03f5f7f11d50a3a_10.0.26100.1_none_9c81814c454e23f1\vbc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\r\FsIso.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\typeperf.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_73c54cb65af16a28\r\rundll32.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_10.0.26100.1591_none_c0c9b77316cf6b10\r\sdclt.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\r\ReAgentc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPUEX.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\r\nvspinfo.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.712_none_b7b410b79e222f1d\imjpuexc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\notepad.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\ScriptRunner.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\DataExchangeHost.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.26100.1_none_5e793e3cf7e6453d\netiougc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-driververifier-tools_31bf3856ad364e35_10.0.26100.1150_none_5ce3f0df6c2eb9bb\verifier.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\r\AssignedAccessGuard.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.26100.1742_none_9c21c77df9054577\tcblaunch.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_6650e9df0164e801\aspnet_regbrowsers.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\WpcUapApp.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_c6fec8639b4d0909\r\sfc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\r\WmsSvc.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_49c71cad8f03abe2\r\TokenBrokerCookies.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\poqexec.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.26100.1591_none_f543f8b3b0fee44f\IMTCPROP.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.26100.1301_none_0b8f997b84f03748\winlogon.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_aa346e257779a3b3\containerworker.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\PeopleExperienceHost.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.26100.1150_none_c0871c4af90b9611\r\ImagingDevices.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.1150_none_e568c5433603cb28\r\msiexec.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.26100.1_none_012c60dec828ce67\ssText3d.scr- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.26100.1150_none_bf072f41973cb733\XBox.TCUI.exe- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fe2ee4cf09ac9f60a53703178996ee14_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 13.1MB
- SHA256 b2d667d40e57ea742e6430c77b219d1a3d16e979d08945076fe473556cc008f4
- MD5 93107160f3801b488dd3ae4810d9b4eb
- SHA1 1aa6462686f176f509ae4413a008ab9ca141011f
- SHA512 a39fb4abd00a4e2ffcb8909e67c5d0d3c0a6de431be6f39e98a7c3d24979a7292ad9b7e6d2a659d172188a41a0cb4990f7dac65a3b6728082789ad309d4ad8c1
- SSDEEP 196608:MgTH2qBpu1QfLIqsu4ouDXSgTH2qBpu1QfLIqsufu5:HTHNBpu1QfckMRTHNBpu1Qfc0O
- TLSH T1E6D62912669A5AACC05FD474CE466965AA323C864F30AFDF0580BE353E766F05F3821F
- MD5 SHA1 SHA512 SSDEEP TLSH