Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 839KB
- Sample260806-btws3a1ane
- SHA256 fff3aad688d969f53ef8a586c76b985f15ad2692259c7244d4979051033579ac
- MD5 85def54c1eb47d35b979f67c9c850d6e
- SHA1 98c3caec2962be9051867a05c23b0b1e6a33e77c
- SHA512 d17216037859664d12569a8381ceeb4304d20aec09f01227a05b9913d9ec2fec1f5f4db55e4a73e5591cf6fc338c789d80d57f3587332cb2454e9cf95f98e74a
- SSDEEP 12288:sz6vYZQQbw4VpaMuPWjobUylPykqADcRrlcQiHmNJLBIuntc:5QZQQbw4ezP0ofyVsWiGnBIutc
- TLSH T181051915B606557DD98BD4B8DB9788378B24788B0735A8EF47C4A2303E677F82F34A06
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shutdown.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\curl.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttunesvr.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SndVol.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\printui.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\bthudtask.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.26100.1591_none_2e9ff92c8dae3783\r\cmdiag.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\wininit.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ysafety-refreshtask_31bf3856ad364e35_10.0.26100.1591_none_fa6fdcd71655ec4d\WpcTok.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPDCT.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\r\WorkFolders.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.26100.1591_none_d92b9cc442553e63\lsass.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.26100.1_none_abdad67b1a4b2829\SecEdit.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-storage-diagnostics_31bf3856ad364e35_10.0.26100.1591_none_1ac5fa16ecade80d\r\stordiag.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.26100.1150_none_3d0419d754916346\wslconfig.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\TiFileFetcher.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-vbc_exe_b03f5f7f11d50a3a_4.0.15912.355_none_8ee5d84e72880b3f\vbc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_73a69603b491b174\RegAsm.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_55245726ccbb616f\autofstx.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netsh_31bf3856ad364e35_10.0.26100.1_none_66e948f094c62ed2\netsh.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpkinstall_31bf3856ad364e35_10.0.26100.1150_none_a51a55a6faf616d3\lpkinstall.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.26100.1591_none_c452ac383bb44c33\RecoveryDrive.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\WSReset.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.26100.1150_none_4572dc061ff88008\appcmd.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.26100.1591_none_479c61fda9b5207c\r\msinfo32.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.26100.1_none_98735c9942cd7928\AddInProcess.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.26100.1_none_39d8198a6bf822dd\WWAHost.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\vmcompute.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\r\dcdiag.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_0949e4cf225d7e03\regini.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.26100.1150_none_69a15f49d214516d\r\Windows.WARP.JITService.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\Magnify.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7161e3793d394d15\sc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.26100.1_none_c1b42dca39a8c2ca\verifiergui.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tioncenter.appxmain_31bf3856ad364e35_10.0.26100.1150_none_9cb5d3bc417a5c42\r\PrintQueueActionCenter.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1301_none_970881ba6260e29a\r\StartMenuExperienceHost.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\HOSTNAME.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dlna-mdeserver_31bf3856ad364e35_10.0.26100.1150_none_71ef838ad2cbc1c0\r\MDEServer.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\r\Mystify.scr- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2c59a493cf48778f\r\msinfo32.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\r\cleanmgr.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.26100.1_none_a4cf8a7d848e0a15\clip.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1150_none_0b85b224b1f670b4\r\DevicePairingWizard.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\ReFsDedupSvc.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-findstr_31bf3856ad364e35_10.0.26100.1150_none_c316dbd9099e9007\r\findstr.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\sftp.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eudcedit_31bf3856ad364e35_10.0.26100.1_none_60e0d7585c6b83b9\eudcedit.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1_none_dcab2356dc81387c\eventcreate.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.26100.1591_none_662e67cdd2014bd1\MuiUnattend.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.26100.1_none_a7bc2b43865e8120\fsavailux.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ldifde_31bf3856ad364e35_10.0.26100.1150_none_bcce913ab8bc643d\ldifde.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_a9f439dd812975b1\wusa.exe- 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_85def54c1eb47d35b979f67c9c850d6e_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.8MB
- SHA256 c7b001a4dc08cd4a43d7bbf35f2c2adaa304856404e94bfc3a968ee2464db4db
- MD5 bbfda0ceccdce7abca66a721bf2b8ae1
- SHA1 c6ed948cc36169c4b97b36b206c27d292672d19c
- SHA512 1efd9d16506b4a45bacb90a396ebbbba99f5e4fd54a1766cae190cac6ca8011cf794a563360811fff8eaff02481b2a45eaefc7b5bc752fa7f7e36f7842506ea5
- SSDEEP 24576:5QZQQbw4ezP0ofyVsWiGnBIut6a7/ezSC6vUyD/aqgrvWx6q8wyuz:yZQZCsyOuP/ezSC6vUzPvMHjy0
- TLSH T1C5853A15F629833AD4A7D0B9CAD7A96AEE313486073088DF038593383E277F55B35729
- MD5 SHA1 SHA512 SSDEEP TLSH