Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
- Size 7.3MB
- Sample260804-yxpkgsgc65
- SHA256 a9a93d1d9d3d2f2c09588d9884266f55d12fa261043d0b5b94a1c47d07d5aba4
- MD5 5887a1c50485e10f3a257e60b8a06c4f
- SHA1 6ea412d8b4d2d28c70abb0ea23f49f55a3a4497a
- SHA512 41b0a11ba19593c6b9243a4bea6267fecbd737383a2314288479c9447b5397d39b1ae0c73734fa9b2869694dc46613b1712adca92939bbabe7e9fe96d22f50ab
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4Og:yevoirV0t/iLwHft8vA8d12RNq6dP
- TLSH T14576E51166D98FE8C05FD474CE4665B69A237C868F309FCF0980BE293E766A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\control.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\regini.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\unregmp2.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SettingSyncHost.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmd.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mountvol.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rasdial.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\autofmt.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rasphone.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\show_third_party_software_licenses.bat- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.546_none_f786fa028426f858\fltMC.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.1266_none_1abb9653828c3f41\f\SecurityHealthService.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\splwow64.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.928_none_0b17415ae0dd0379\r\hvc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csrss_31bf3856ad364e35_10.0.19041.1_none_0ed4f15b837334c7\csrss.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.19041.1_none_6314a7411fa6f2ec\FXSSVC.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\TSTheme.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\GamePanel.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.19041.1_none_1278095646355851\net.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.906_none_a892faef80a943dc\f\MuiUnattend.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.19041.746_none_bd9bc99304595128\ReAgentc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\f\nltest.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19041.1_none_b4528a0bdf7b6cee\SMSvcHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_d7b5820f5a89765b\f\agentactivationruntimestarter.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1_none_987b063fd85ba334\memtest.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting_31bf3856ad364e35_10.0.19041.1237_none_bd2b0ef5b58e1540\cscript.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\tracerpt.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.19041.153_none_580ef30a6bb05e53\browserexport.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.19041.1_none_4c13d8f934672657\driverquery.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemreset_31bf3856ad364e35_10.0.19041.1266_none_5fd6523a3130632d\r\systemreset.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.906_none_23e2379a6f03d0cb\f\gpresult.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\WMIADAP.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.746_none_251e769058968366\f\Dxpserver.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.19041.173_none_f837263e7fdd508f\sppsvc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qprocess.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.19041.1_none_19de3c7b933c6faf\eudcedit.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_e341f52007f6d1a8\f\wecutil.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.1_none_3451e3c68828f3da\smss.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\MRINFO.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_f28ba6a10743aebc\SpeechModelDownload.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmEngine.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-thumbexthost_31bf3856ad364e35_10.0.19041.1_none_a65e065ddcc839c0\ThumbnailExtractionHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gpowershell-exe_31bf3856ad364e35_10.0.19041.1_none_f8d6d7787573666b\powershell_ise.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.19041.1_none_d151c6f3c90b1e0b\RunLegacyCPLElevated.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.19041.1_none_0d3d1dcf5184d281\appidpolicyconverter.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmappinstaller_31bf3856ad364e35_10.0.19041.153_none_7799fc2afae9a500\f\MDMAppInstaller.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1_none_906b4c073d1d970c\msconfig.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\r\tracerpt.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.19041.746_none_7aa85dbabd7172c7\PrintIsolationHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.19041.1_none_2a5f489c740a390b\sc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmimageworker.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\setupugc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\winhlp32.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVShNotify.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.117_none_1db60e061b48335a\bash.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\tpmvscmgr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.19041.1_none_95647fabfa4ec9fe\MultiDigiMon.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WmiApSrv.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.19041.746_none_d19001beed7624dc\CertEnrollCtrl.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\f\uwfmgr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.19041.1_none_77274ce3b079d8f5\MicrosoftEdgeCP.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_2a38e2996ee84e57\TapiUnattend.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-packagemanager_31bf3856ad364e35_10.0.19041.1_none_a2c8d19f92a1cc22\PkgMgr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoftwindows-undockeddevkit.appxmain_31bf3856ad364e35_10.0.19041.488_none_7201e1dc944d1765\f\UndockedDevKit.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1_none_8f3a372b5909de8a\wiaacmgr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1_none_e6d5a48c4da284da\aitstatic.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1151_none_e0e8a531e34051a9\r\HelpPane.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.19041.746_none_e72c4ffca9db7315\f\lpkinstall.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.19041.746_none_cd77eb91574a2623\r\sysprep.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 7.9MB
- SHA256 edc1d6159ec1f9539a37111031be235c003aa50e387b42fb8c2b6b15cee1d1f2
- MD5 00a50d013e03e635c988a73d818fce78
- SHA1 2b3ee659bce9d6c86df142eeb7a403a702556e41
- SHA512 fa20b26fea44c17374e0bbd232491eeb40e8eedb27ff7645a1b364592c3ddfadc0b3d1c839bc9542180f98f2e011383efc4e39cbdee2a288ec7192a2c539e550
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4OT:yevoirV0t/iLwHft8vA8d12RNq6d/jo9
- TLSH T14986F61166D58FE8C05FD074CE8665A69A237C868F309FCF0980BE293E766E45E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH