Analysis
- max time kernel
150s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
- Size 7.3MB
- Sample260804-yxpkgsgc65
- SHA256 a9a93d1d9d3d2f2c09588d9884266f55d12fa261043d0b5b94a1c47d07d5aba4
- MD5 5887a1c50485e10f3a257e60b8a06c4f
- SHA1 6ea412d8b4d2d28c70abb0ea23f49f55a3a4497a
- SHA512 41b0a11ba19593c6b9243a4bea6267fecbd737383a2314288479c9447b5397d39b1ae0c73734fa9b2869694dc46613b1712adca92939bbabe7e9fe96d22f50ab
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4Og:yevoirV0t/iLwHft8vA8d12RNq6dP
- TLSH T14576E51166D98FE8C05FD474CE4665B69A237C868F309FCF0980BE293E766A05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\convert.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\imecfmui.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\OpenWith.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ntprint.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\msra.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\recover.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WinRTNetMUAHostServer.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\r\explorer.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\r\mspaint.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAgentPolicyGenerator.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_9e1d25f83a6fdbc2\unlodctr.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\r\LicenseManagerShellext.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_200ace4b24b1d248\chkntfs.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-applaunch_exe_b03f5f7f11d50a3a_4.0.15912.0_none_f22ff467d1513409\AppLaunch.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-csp_31bf3856ad364e35_10.0.26100.1591_none_83cfa386bbdf1361\r\hvsievaluator.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core_31bf3856ad364e35_10.0.26100.1591_none_944de837a97599ab\MLEngineStub.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngentask_exe_b03f5f7f11d50a3a_4.0.15912.0_none_d5e7146d665097c0\ngentask.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpconfig.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\pcalua.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\r\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lockapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_83300daf83f8b2a6\r\LockApp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.26100.1591_none_37c9b95250fac754\r\perfmon.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\r\wmplayer.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\AddSuggestedFoldersToLibraryDialog.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1150_none_b36c622d6cabda77\auditpol.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\NetCfgNotifyObjectHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_10.0.26100.1150_none_3d9125d57cc0da9e\r\WMIC.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\nvspinfo.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1150_none_e00b3f2ca36be9f9\dllhst3g.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpinit.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFaultSecure.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-inputredirection_31bf3856ad364e35_10.0.26100.1591_none_9fe4b2d813f9a989\rdpinput.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-choice_31bf3856ad364e35_10.0.26100.1_none_caaf3dbf28b048ab\choice.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFault.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_0bc717c8ecd0287d\WerFault.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PING.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1150_none_7f2121a6ad7592a8\PackagedCWALauncher.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.26100.1150_none_48fdcfd155028bbe\r\cipher.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_a44e7056d0e44981\TpmTool.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-clr_ilasm_exe_b03f5f7f11d50a3a_10.0.26100.1_none_5fa297562cdb430e\ilasm.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\r\msinfo32.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.26100.1591_none_9271e9806df3ec14\MBR2GPT.EXE- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-twinui_31bf3856ad364e35_10.0.26100.1742_none_0f4cbac5697cd3b6\LaunchWinApp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\runexehelper.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\r\wscript.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\mofcomp.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hns-diagnosticstool_31bf3856ad364e35_10.0.26100.1591_none_41d04808d6b6d160\r\hnsdiag.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_5887a1c50485e10f3a257e60b8a06c4f_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.3MB
- SHA256 842347210156bebe7c03b7e132fea899e034edcb86bf76517e770a7fbf18b670
- MD5 8ff0860569ab7b5ce8b19af0453b39e8
- SHA1 048b0592a790eb815abf89839c52b62904dfb3ef
- SHA512 a5ba6282e01364779273984079cbff3b954d52850e13811d9197996708e99ec8f66fa2962b8d4c8e4ba549f5f71df46ed6004b68cb2cdb13b2d2bc8936e43ce0
- SSDEEP 98304:yevoirV0t/iLwHft8vA8d12RNq6dMezSC6v2XMHw:BjrOOwH+v/d12RNRdLz
- TLSH T10496F71165D58FE9C06FD074CA8665B69A237C868F309FCB0980BE283E766E45E3531F
- MD5 SHA1 SHA512 SSDEEP TLSH