Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 16:17
Behavioral task
behavioral1
Sample
2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 8.1MB
- Sample260805-trkbcswvgx
- SHA256 3aa5e3b1caede01c02f48eaf6c2f28f1f287148b2068bd683eb52bd65ef71c26
- MD5 224b0205795be98c9f46e50b0c6cef85
- SHA1 92bed24d27f55da252e6d36cff901991be4a3cf7
- SHA512 d8f2d70629d0df43996671da216d54ae46740176c8b3cad69e6286968bf8323d414421cc5e3f387272f97e6d755c6ee2c0db118263d89d0f0a19a7dca6ec665f
- SSDEEP 49152:9TAnMpYq7VBXdceWNNx3K7U6qPC8BVs7PM3V3UKCOX6EF83m2jKHXyoYM2Tl6+1t:9TAnM66deIo6qzBPxNSslfT6b
- TLSH T145860819A9D58FE8C05FD074CA4266AA99237C458F205FDF0980BE297E76FB05E3421F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\tttracer.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\label.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Magnify.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PING.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesHardware.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\IMEJP\imjpuexc.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\user.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\autofstx.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rekeywiz.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\expand.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Robocopy.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\AtBroker.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fixmapi.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fsutil.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\ReAgentc.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe -
resource yara_rule behavioral2/memory/2900-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000d00000001c518-5.dat upx behavioral2/memory/2900-485-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/2900-2915-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-wpd-shellextension_31bf3856ad364e35_10.0.26100.1301_none_b74a2f61ab292fb3\r\WPDShextAutoplay.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-displayswitch_31bf3856ad364e35_10.0.26100.1150_none_88a9016fd4655cfd\DisplaySwitch.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsselfhealingsvc_31bf3856ad364e35_10.0.26100.1150_none_17cfd41bb43a934d\r\WmsSelfHealingSvc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\NETSTAT.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\Microsoft.Uev.CscUnpinTool.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..onentpackagesupport_31bf3856ad364e35_10.0.26100.1150_none_fba3bb9888bf82a5\r\CompPkgSrv.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\cmstp.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-where_31bf3856ad364e35_10.0.26100.1_none_5ac6e18046b72d8c\where.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1_none_e76b3de73182bef6\ByteCodeGenerator.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_10.0.26100.1_none_89ffc359e797abf7\cvtres.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.26100.1591_none_48bae61d0882b74d\UNPUXLauncher.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.0_none_98d146a6029264ee\vbc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_9345e45e568242fb\r\IMJPDCT.EXE- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wrp-integrity-client_31bf3856ad364e35_10.0.26100.1591_none_d15372b5cfadcb04\sfc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_bsdtar_31bf3856ad364e35_10.0.26100.1150_none_f2155cb81beac176\tar.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.26100.1150_none_830db7779a4e1286\openfiles.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.26100.1591_none_f781c7c3859127ad\r\Microsoft.AAD.BrokerPlugin.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.26100.1150_none_56a128e615a8ea59\r\RdpSaUacHelper.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\r\MoNotificationUx.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpasvc-esimtool_31bf3856ad364e35_10.0.26100.1150_none_77014dd1054075c3\esimtool.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.26100.1_none_fdbd1ab52483d881\efsui.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.26100.1150_none_1c37124e142944f8\DiskSnapshot.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\winrshost.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_9493bccc1124c937\mshta.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_48e47fdfbf0a33b1\TiFileFetcher.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\r\SndVol.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\r\bfsvc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.26100.1150_none_e8f8e178bc55f481\bitsadmin.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1_none_ea8223e29a7906a5\PackagedCWALauncher.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.26100.1_none_4b6c4168906f5df6\dllhst3g.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.26100.1150_none_7c0a3bab447f4af9\ByteCodeGenerator.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cloudnotifications_31bf3856ad364e35_10.0.26100.1591_none_2dc797084143cfaf\r\CloudNotifications.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.26100.1150_none_85b50275334e6c75\r\uwfux.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\desktopimgdownldr.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\bthudtask.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.26100.1_none_7b547ea3515807e4\smss.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.26100.1591_none_be5055bdfc720d1e\r\UtcDecoderHost.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\SearchHost.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandbox.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.26100.1591_none_59ddd41753bfcf7d\Narrator.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.26100.1_none_28969e415f79b32c\AuthHost.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shell-customshellhost_31bf3856ad364e35_10.0.26100.1591_none_245703c14f08d5aa\CustomShellHost.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe- 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_224b0205795be98c9f46e50b0c6cef85_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2900
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 9.1MB
- SHA256 a1e9c5a17cd3bf2e08b2d07eb86a57aefb9dfe2a28d9ecc6d02b37f656b53cd6
- MD5 c4acfb16809a90614a0a40936b4f7dd9
- SHA1 8c6325a79d095b3806e8df2a2540e79bf65ab9ac
- SHA512 aed23357a74210035656e8aca9e3cefb8cf73275c67db763da4b5efa7fb837eda684c639bf63a07b4bf9968f5e52fe7c68b971f5088cf82cff65981dfd254f6b
- SSDEEP 98304:9TAnM66deIo6qzBPxNSslfT6AezSC6v2XMHH:9TAM66dPqzBHzT6Hg
- TLSH T100A6F819B9998FE9C05FD074C98266AA99237C454F205FDF0980BE287E36FE05E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH