Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 18:58
Behavioral task
behavioral1
Sample
2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 6.5MB
- Sample260804-xmpbasv1bz
- SHA256 3be3fdb57cd9b4ae882a1beb4d5b975127b651df2e0e8b8a9bed72906d1ae1c5
- MD5 a29b292029d529032caa18f4b4e83657
- SHA1 bf8737c11780369b2997eeac89ab58965bb5b8cd
- SHA512 18d2376188d43d0b9df1cb09b213effc085d97db329def4d4f0b4fc6bb9dd177629fb71d568414ac5a3e6ee805743e0ddd2923d1e279cb0a8abd19820f141378
- SSDEEP 98304:8KUgTH2M2m9UMpu1QfLczqssnK1jou/nbXaPk:MgTH2qBpu1QfLIqsu4ouDXt
- TLSH T10C664C12669A146CD16BD478CB4B8A16EA317C870B31A9EF0281B2353F77BF46F39315
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\replace.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\xwizard.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\at.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\psr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpscript.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\format.com- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\msra.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\netbtugc.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\where.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dxdiag.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\gpupdate.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\net.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/3748-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c5cc-5.dat upx behavioral2/memory/3748-461-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3748-2918-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.26100.1591_none_13357425571b7ed9\r\OpenWith.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmplayer.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-optionaltsps_31bf3856ad364e35_10.0.26100.1_none_e94490f765d02436\tcmsetup.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1_none_1d7ec919ce94ac2f\winrshost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_90ebc90aafaeeb97\r\pcwrun.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_af2434cfb8eecc10\clip.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapphost_31bf3856ad364e35_10.0.26100.1591_none_97668666133579f2\r\LockAppHost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\subst.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1_none_49050f53b3863739\EhStorAuthn.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\AppVClient.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dialoghost.appxmain_31bf3856ad364e35_10.0.26100.1150_none_ab86ca35f5ea21f3\CredDialogHost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\hh.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\notepad.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\nfsadmin.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.26100.1_none_131779f41084e8ab\InspectVhdDialog.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proximityuxhost_31bf3856ad364e35_10.0.26100.1150_none_30e310bffc56cea9\ProximityUxHost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\sdchange.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\vfpctrl.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..rity-spp-validation_31bf3856ad364e35_10.0.26100.1150_none_b6d21851d2f58ac9\r\GenValObj.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.26100.1150_none_4f487e99a54cb5d2\SystemSettingsRemoveDevice.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\msra.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1_none_216e3761f97ed1b2\sdiagnhost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\r\coredpussvr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.26100.1591_none_d5752f789b3d8f3a\r\dmcertinst.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\r\IMJPDCT.EXE- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\resmon.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.26100.1591_none_b7cec9dc382cb5f1\WmsManager.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\SearchHost.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1_none_6abdc3ad5e5ae2d2\RdpSaProxy.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.26100.1_none_a7bc2b43865e8120\fsavailux.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\r\rasautou.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1_none_d5026185bf17c56a\Windows.WARP.JITService.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-managementconsole_31bf3856ad364e35_10.0.26100.1591_none_239398876b1e5306\r\InetMgr.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\ssh-agent.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\winhlp32.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_8e19b8855461fe2c\charmap.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\r\MicrosoftEdgeCP.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..daryauthfactor-task_31bf3856ad364e35_10.0.26100.1150_none_67ed785bf55a7a21\DeviceCredentialDeployment.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\r\SensorDataService.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vds.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.26100.1150_none_d11fa90f43730842\rdpsign.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-service-shared_31bf3856ad364e35_10.0.26100.1301_none_22d8cfb46252dd83\r\WDAGNetDiag.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1150_none_dda40d17c682c33c\r\EhStorAuthn.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.26100.1_none_dd2e628f17bcb344\TSTheme.exe- 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a29b292029d529032caa18f4b4e83657_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3748
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.4MB
- SHA256 664ca51816dbb532a8ed37fb3cc3dbb87f2a03bf728e21927a0b67ffac9cb207
- MD5 821d6ce5005019c1736df92e242fc332
- SHA1 28fd9ab5d91df11c89f4a95e4afc2123e2429aa1
- SHA512 09945c9bc09d066b4b0655eb98cebc93c0b7a5cbf12c997b8ff04b452f47a172968af9f7a47c8d63416d26a527707664b08b75ca8ab857b827d499995b3bc8c8
- SSDEEP 98304:8KUgTH2M2m9UMpu1QfLczqssnK1jou/nbXaP9ezSC6v2XMHP:MgTH2qBpu1QfLIqsu4ouDXZ0
- TLSH T181764C12B669116DD06BD4B8CB879A16EE3138860730A9EF0285B2393F77BF45F39315
- MD5 SHA1 SHA512 SSDEEP TLSH