Analysis
- max time kernel
151s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:17
Behavioral task
behavioral1
Sample
2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
- Size 14.6MB
- Sample260804-y23ynsgd48
- SHA256 b5b163002b4eb672839a0802c16b696c59e011f6a83e605592956d6ee361b930
- MD5 50f9975073c68ce4b44c4b22d14645d8
- SHA1 9f19a9f60d1e6ef2ef95cbc660aedc0177c54013
- SHA512 475e9b025fa5783a56c7d9c1845d41b2053225f7ecf0e06d94630e814bab20b3ed722585522c38181493a0aef1aeb340845394bd5dbb4c95804af8b49599a76f
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6ie4gTH2qBpu1QfLIqsufX:ERXMzXdyZ/K0trFC4TTHNBpu1Qfc0X
- TLSH T136F63A12F1954B98C05FD074CE46A661AA733C454FB09BDF5988BE683E366F06E3821F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regsvr32.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\logagent.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\sfc.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\attrib.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\choice.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\finger.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\cttune.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\mode.com 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\upnpcont.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe -
resource yara_rule behavioral2/memory/4228-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x0006000000016b3f-5.dat upx behavioral2/memory/4228-224-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\7-Zip\7zG.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\r\dsdbutil.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\r\nltest.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.26100.1150_none_3c9a0c46a6db0711\WinMgmt.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_edmgen_b77a5c561934e089_4.0.15912.0_none_b064199c91afa844\EdmGen.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-label_31bf3856ad364e35_10.0.26100.1_none_5422b42832d51a31\label.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.26100.1150_none_35ab52a6398cdc65\SnippingTool.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_5bd9bd7b9da089d6\MuiUnattend.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\MRINFO.EXE- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\ScriptRunner.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.26100.1591_none_e980cb58b559b151\RelPost.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.26100.1591_none_685b4f9deb1e8307\dstokenclean.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\r\MicrosoftEdgeDevTools.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\r\Windows.Media.BackgroundPlayback.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-extcom_31bf3856ad364e35_10.0.26100.1591_none_a6992e1af01c7fb5\SppExtComObj.Exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.26100.1591_none_667b1b04bd3f5cbc\CredentialUIBroker.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.26100.1150_none_1ab61fff20240053\EASPolicyManagerBrokerHost.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_457f9751bea691f1\replace.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\HelpPane.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_addinutil_b77a5c561934e089_4.0.15912.0_none_feb4ea54186c4c66\AddInUtil.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\AppVNice.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\CompMgmtLauncher.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.26100.1150_none_ac4a0f023b4ef24a\WmiPrvSE.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\r\esimtool.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmdl32.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_42528c82d31b82f1\cvtres.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\r\dllhst3g.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\findstr.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\NcsiUwpApp_8wekyb3d8bbwe\NcsiUwpApp.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm_31bf3856ad364e35_10.0.26100.1591_none_482bc815c9162047\dusmtask.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.26100.1_none_dc91fd1f1af84c4d\MSchedExe.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.26100.1591_none_8897bf42a34b1ceb\PkgMgr.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\Microsoft.AAD.BrokerPlugin.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..plicationframe-host_31bf3856ad364e35_10.0.26100.1591_none_756d2e37dd0406ef\ApplicationFrameHost.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\r\BitLockerDeviceEncryption.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..commandlinetoolsmqq_31bf3856ad364e35_10.0.26100.1_none_261d19c21491b907\qwinsta.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi_31bf3856ad364e35_10.0.26100.1150_none_24e2f2e0c4c87239\r\wimserv.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_regiis_exe_b03f5f7f11d50a3a_10.0.27000.360_none_ad704d12215bf117\aspnet_regiis.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh-sk-helper.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-assignedaccess-guard_31bf3856ad364e35_10.0.26100.1150_none_ce90aa676fe2a555\AssignedAccessGuard.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..iodatamodel-library_31bf3856ad364e35_10.0.26100.1591_none_10d0d236e479806f\WinBioDataModelOOBE.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\SystemApps\Windows.CBSPreview_cw5n1h2txyewy\CameraBarcodeScannerPreview.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1150_none_d7504f768bde2804\gpupdate.exe- 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_50f9975073c68ce4b44c4b22d14645d8_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 15.5MB
- SHA256 a661ccc0655cc62d50d068f4b535892988105acd8810737136ac6c105a9fa9a3
- MD5 13018e8038f8e65ad2a54394a7b3c3ff
- SHA1 4eb4fa7d6ae7c5612b1d0d5069cd0d833449b0c1
- SHA512 0a4a9f8eb655a710e99660411cee083b5d6d60aaab92d67b5a2881724e365be41fb1f1b0b87db12890a41ffa1f71e920b648aa24e0801b3536e41c8e3fff82b8
- SSDEEP 196608:ZaHxXME6A6CWyZ/K0tM6SohcIy6ie4gTH2qBpu1QfLIqsufTI:ERXMzXdyZ/K0trFC4TTHNBpu1Qfc0s
- TLSH T13BF64A12F1A58BA8C06FD074CE46A665EA333C454F709BDB5544BE683E366F06A3831F
- MD5 SHA1 SHA512 SSDEEP TLSH