Analysis
- max time kernel
148s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:03
Behavioral task
behavioral1
Sample
2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 6.9MB
- Sample260804-ysv7gagb67
- SHA256 4c1a4441e3f52d00fb0d130b63f36f1292e506a9f8c68b4a6d80446996a338ff
- MD5 5eb72fee6ea75a08b979eff2d509bfdd
- SHA1 e1bb6dbb52c3a8a2cb5c571192b4cfee196b9f62
- SHA512 92594ac6b62af0f36c65efd69ee120fdd81dcfb0253f6b67fba6a0332a0ae94646cf21014e1eec7c491e56099ddf20ae9ed78b983df06821ba4d17f998fd23ec
- SSDEEP 98304:8KUgTH2M2m9UMpu1QfLczqssnK1jou/nbXaPa60:MgTH2qBpu1QfLIqsu4ouDXJ60
- TLSH T17A764C12A65A146CD16BD478CB4B8A16EE317C860731A9EF0285F2392F77BF46F39311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SyncHost.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscript.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5724-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c4f4-5.dat upx behavioral2/memory/5724-590-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5724-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c6c9a6c536b87ee9\mscorsvw.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_ab188e2525bde8ce\mmc.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.26100.1150_none_de2664616a7b438a\r\OOBENetworkCaptivePortal.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.26100.1591_none_d0b554d77644b199\wowreg32.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15912.365_none_068e99c8dd0d8394\aspnet_wp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\r\ClipDLS.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-livecaptionsstub_31bf3856ad364e35_10.0.26100.1150_none_09962246afa36462\r\LiveCaptions.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\NetCfgNotifyObjectHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.26100.1_none_53510033c4b43552\srdelayed.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\wscript.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_1fb74192d4a9efd6\InstallUtil.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\Microsoft.AsyncTextService.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\cmproxyd.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-dsdbutil_31bf3856ad364e35_10.0.26100.1150_none_db80809a7f5d5459\r\dsdbutil.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_87331ff41de2f505\schtasks.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-secinit_31bf3856ad364e35_10.0.26100.1_none_84ab98d8358ad394\secinit.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\r\BitLockerWizard.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1_none_0c53e49062af0dd7\SystemUWPLauncher.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\r\TrustedInstaller.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1_none_e76b3de73182bef6\ByteCodeGenerator.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.26100.1591_none_75b5554a02bcd133\r\AtBroker.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1_none_a41d9d6e453f907f\convert.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\r\nvspinfo.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\r\Windows.WARP.JITService.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\r\printfilterpipelinesvc.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\r\SecurityHealthService.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1150_none_4db6a2c1b58489e5\r\diskusage.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.26100.1150_none_80212900f68082da\dialer.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_8f56b2193eadb75b\CertEnrollCtrl.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\LKG\MicrosoftWindows.LKG.Search_cw5n1h2txyewy\FESearchHost.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-makecab_31bf3856ad364e35_10.0.26100.1_none_edc32a46d1cb7363\makecab.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmstp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.26100.1150_none_f6b51f53ae693de3\BrowserCore.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_10.0.27000.360_none_1f384179f4f31b5d\vbc.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\IMJPUEX.EXE- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1_none_6abdc3ad5e5ae2d2\RdpSaProxy.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-synchost_31bf3856ad364e35_10.0.26100.1150_none_05685d8fac7c4f66\r\SyncHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\MiniSearchHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1591_none_19bc1d299dc8c2e1\r\LaunchWinApp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_38f087fa4098616b\ctfmon.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_42528c82d31b82f1\cvtres.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1_none_1df4641271a5054b\UserAccountBroker.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\setup16.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mnotificationbroker_31bf3856ad364e35_10.0.26100.1_none_c4a8407c4f3e3810\DmNotificationBroker.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpapi-keys_31bf3856ad364e35_10.0.26100.1_none_7ac67b5c35fd6e5c\dpapimig.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssadmin_31bf3856ad364e35_10.0.26100.1150_none_6064a5e6e18d90dc\r\vssadmin.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\certutil.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1_none_b7f01667e525edde\dcomcnfg.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.26100.1150_none_71ef838ad2cbc1c0\r\MDEServer.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\r\PhotoScreensaver.scr- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.26100.1591_none_b60058d9621fad85\wscadminui.exe- 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5eb72fee6ea75a08b979eff2d509bfdd_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.9MB
- SHA256 ca43d3a1de1d320ad7aee0d4452733553f47438f20a1047cc7ed4eec7e2172cb
- MD5 0267a94f88dbdd477a85302bbdc70105
- SHA1 c0ef48d1e307deaed5660a03ef9ed282aa0ed439
- SHA512 674e8c241e88615089981d61a19497265b9050cacb869be327f5899e6859adf4e633695deadb4d6f03b0b87b3578dd44b93f14632e2fb6571f0cd0bcc39ff460
- SSDEEP 98304:8KUgTH2M2m9UMpu1QfLczqssnK1jou/nbXaPa6NezSC6v2XMHc:MgTH2qBpu1QfLIqsu4ouDXJ6qn
- TLSH T12F864B12B669516CD067D4B8CB879A16EE3138860B30A9EF0285E2393F77BF45F39315
- MD5 SHA1 SHA512 SSDEEP TLSH