Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:55
Behavioral task
behavioral1
Sample
2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 9.0MB
- Sample260808-cb4xdsfp6s
- SHA256 1fac58a2bbbb4bb34a7717661b2c0da27090704d8531d47c17618a199b8eb2d7
- MD5 0e9b9b00664d7dba4b0e06a40f7dba8a
- SHA1 87ab7bc88d431aae777e9e8955805ec7d8201a3a
- SHA512 2b5ed30e142076aee9e5c6e81942b16d5b22ae16d82e1d04479396c864d12eeb35e3bee04a918d5f80e02c1bb4e0d48907bda113019d7164f229511ce3b57c3c
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGfjo3jor:ZaHxXMZ6466HtIto0Aaozor
- TLSH T113960855F223B96EC34794348019C933B9203BAC57B34CBBF88CF5B4ED2A5676529E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\icacls.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GameBarPresenceWriter.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verclsid.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DpiScaling.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dvdplay.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\print.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\GamePanel.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\perfhost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5496-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c56c-5.dat upx behavioral2/memory/5496-480-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5496-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\mpextms.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-servicing_31bf3856ad364e35_10.0.26100.1150_none_c1fbd1a9557e5b13\bfsvc.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browser_broker.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.26100.1591_none_4606dbfb8b0028fd\dasHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.26100.1591_none_2c8539fa8a63de14\DataStoreCacheDumpTool.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard_31bf3856ad364e35_10.0.26100.1_none_4d201f2d5466838a\WmsDashboard.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..rvices-sessionagent_31bf3856ad364e35_10.0.26100.1_none_829a5953e9a4b444\RdpSa.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\r\WpcUapApp.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\UUS\amd64\wuaucltcore.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\convert.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1150_none_b6d5fc573e6d363a\dccw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\w32tm.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1150_none_b29361d684a1914e\r\UserAccountBroker.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.26100.1150_none_cf3b1bf5ee04490b\WaaSMedicAgent.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_c68b578eea4bd528\r\wermgr.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_773b7b96c37cb0e9\DpiScaling.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mobsyncexe_31bf3856ad364e35_10.0.26100.1150_none_8b382a05043f0680\mobsync.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net1-command-line-tool_31bf3856ad364e35_10.0.26100.1150_none_22c343e8047d12d1\net1.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.26100.1_none_20d605b4c2450a61\fltMC.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.PrintQueueActionCenter_cw5n1h2txyewy\PrintQueueActionCenter.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-magnify_31bf3856ad364e35_10.0.26100.1591_none_09edd29348b6b707\r\Magnify.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_10.0.26100.1_none_08f675ddb6f77c4f\dvdplay.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\TextInputHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_9f7e48f0022da658\aspnet_compiler.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_0e2538fcfbcfdda3\certreq.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_11.0.26100.1_none_9493bccc1124c937\mshta.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.26100.1591_none_3f2e181ddb9e8c83\WpcUapApp.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\Ribbons.scr- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.26100.1_none_a05e61712d324fe9\dfrgui.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.26100.1591_none_a4b44acdd9ec4aa3\r\DWWIN.EXE- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.26100.1_none_dcab2356dc81387c\eventcreate.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingcore_31bf3856ad364e35_10.0.26100.1591_none_bc36ad3cb5eb132d\wermgr.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg_31bf3856ad364e35_10.0.26100.1150_none_ac162c2f01636f98\r\netcfg.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1591_none_d3181252b1eca58b\msra.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssvc_31bf3856ad364e35_10.0.26100.1591_none_5c83ef5441ff2734\WmsSvc.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\sdchange.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..nfrastructurebghost_31bf3856ad364e35_10.0.26100.1_none_6de688b2d1a76706\backgroundTaskHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.1150_none_0c098ad82e53afc9\r\NetCfgNotifyObjectHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..eminputhost-process_31bf3856ad364e35_10.0.26100.1150_none_24aebd36aef95f82\ISM.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_c435ce459c01d610\mscorsvw.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-commandline_31bf3856ad364e35_10.0.26100.1150_none_cb65497b42fc406d\Dism.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ddodiag_31bf3856ad364e35_10.0.26100.1_none_334a3a73057b472f\ddodiag.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-healthattestation-csp_31bf3856ad364e35_10.0.26100.1591_none_c6d9ee3b6b5cb11f\r\HealthAttestationClientAgent.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.26100.1591_none_e0bca845ce26528b\MDMAgent.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.26100.1742_none_fcf4914266c3a69d\r\ApplyTrustOffline.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.26100.1591_none_5181bbfe74a17a20\FsIso.exe- 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_0e9b9b00664d7dba4b0e06a40f7dba8a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5496
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 10.0MB
- SHA256 9ea49ec7a0095ff63295fbb132b5b382806df98d142c82e13cfc7d784ad7a10c
- MD5 ee99bc80ae58a74cacda0dd3d8e7de2a
- SHA1 163f62480d5aa2ba9148a740d6c1199d55136de2
- SHA512 fbb3f0027fe258cc82a2256eaf9d4cc536cd9bb621fa1d90b735cd930e51f81665888e47809d17a0f47a4d164eadf78dfe7acf4085f4f147b81fc799d1a89703
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfFcNFcEuwLNe9ajRpoGfjo3joQezSC6v2Xo:ZaHxXMZ6466HtIto0Aaozo3o
- TLSH T19AB62955F223A57EC347C4348059CA33B9203B6947B34CBBB888F6B4FD2A5676529E31
- MD5 SHA1 SHA512 SSDEEP TLSH