Analysis
- max time kernel
149s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 15:47
Behavioral task
behavioral1
Sample
2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 6.4MB
- Sample260808-s8gfcsec27
- SHA256 381c610cb6cb167f9adb35181bb5287dfd7eea454699075f93d4afaee3e4a71b
- MD5 983f53dc1cd5afc514d65566f3c10279
- SHA1 d95b835b0f0aae8d3ec5db5494ddd3016ac428a0
- SHA512 3297dfe3cc5cc2246a6d4474e29542cfcb3bd4be8f1eeb2d788b29033070b49bf886072b6a19a8d881bf63822e058c8c4436e1b2697d405cdd400751597da309
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqm:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfC
- TLSH T11566F846F223A86EC346D9348418C932A5203FBD57B30DBBFC5CF1A4FA2A5677519E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontdrvhost.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\findstr.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontdrvhost.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\SpeechModelDownload.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CertEnrollCtrl.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\format.com- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\regini.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Fondue.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WSManHTTPConfig.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\notepad.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral1/memory/4392-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x0003000000022b83-4.dat upx behavioral1/memory/4392-892-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/4392-3224-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\FsIso.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\r\notepad.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1288_none_3f2d1be96237886e\r\WSManHTTPConfig.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1060d2d22df7c6eb\f\WWAHost.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\r\pcaui.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runas_31bf3856ad364e35_10.0.19041.1_none_202e011a312bab1d\runas.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\SyncAppvPublishingServer.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\CustomInstallExec.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..tegrity-diagnostics_31bf3856ad364e35_10.0.19041.985_none_4a26c2c5164ad5c7\f\CIDiag.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\hvsirdpclient.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\plasrv.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.19041.1_none_a99795d4c367fea1\RMActivate_isv.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..pertiescomputername_31bf3856ad364e35_10.0.19041.1_none_f0b8ea270ffc4674\SystemPropertiesComputerName.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_49716c2392052aca\diskperf.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\setup16.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.84_none_81616275259e37fe\r\ImeBroker.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcore_31bf3856ad364e35_10.0.19041.1151_none_21b291c4f7bdb6e0\nfsclnt.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.19041.1_none_233b627ec80a87f1\xcopy.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lications-clientsku_31bf3856ad364e35_10.0.19041.1266_none_93a0f3defb54e912\f\rdpshell.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uso-dtuhandler_31bf3856ad364e35_10.0.19041.153_none_c0c4ee134c2535a0\r\DTUHandler.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\MBR2GPT.EXE- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.153_none_1721bd4ad34c0544\r\MusNotifyIcon.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.19041.746_none_726cc4a1ebcb1c1e\f\wlrmdr.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..perience-ait-static_31bf3856ad364e35_10.0.19041.1202_none_a5a4c3f2637b55fa\aitstatic.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.19041.1_none_4cc7187cbf1ef970\psp.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\XGpuEjectDialog.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\f\pcwrun.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.19041.746_none_a47144c464d15475\f\WSReset.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.19041.1_none_d1ffdc3927836528\WmsManager.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\r\WorkFolders.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\f\hvsirpcd.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1266_none_22b99d078bbc3016\unregmp2.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\f\PhotoScreensaver.scr- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.746_none_790f12933fbf7e0d\r\rmttpmvscmgrsvr.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cttunesvr_31bf3856ad364e35_10.0.19041.746_none_cdf422107d2779cf\r\cttunesvr.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-certificateinstall_31bf3856ad364e35_10.0.19041.1151_none_ae854961a06058b2\r\dmcertinst.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.153_none_212a5b73f083deb3\SystemResetPlatform.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.19041.1_none_5106d54a804dbfc3\tpmvscmgr.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.19041.1266_none_ba0845abb58c8bdd\f\BioIso.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.262_none_e73f0197262d9fec\TiWorker.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\rstrui.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\r\SgrmLpac.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-at_31bf3856ad364e35_10.0.19041.1_none_02f2b1ed23420c30\at.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.1_none_d1fafd8eeb2a2637\SpeechUXWiz.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-securityhealth-sso_31bf3856ad364e35_10.0.19041.1_none_753cc0191556f0a2\SecurityHealthSystray.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz-exe_31bf3856ad364e35_10.0.19041.1_none_a347c249afbf6f97\Netplwiz.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.207_none_11794cc79cc85d1d\r\WaaSMedicAgent.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-openwith_31bf3856ad364e35_10.0.19041.746_none_556ec3cb05e3ec5a\r\OpenWith.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\r\BackgroundTransferHost.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_8ddc3834fb6f659f\iscsicpl.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\pcaui.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\MDMAgent.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\f\XblGameSaveTask.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.1081_none_ef39acce2648e404\r\WerFaultSecure.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\f\ntoskrnl.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\UsoClient.exe- 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_983f53dc1cd5afc514d65566f3c10279_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 6.9MB
- SHA256 b097a740d9050defcb4af002897120060e4c8b3a213926b3977a131350025437
- MD5 564f732e73c50d4fb96e18e127a54043
- SHA1 a8be4cb3082ef8184fdad74de13bb86408c57b35
- SHA512 f6ed7578f378536e8b50152b2923359d211940f4df0d82f1a5c7f26886a48f7db11035b269be20ea8902fb5224e1ced7cae204314e45cc89e35093070c4a2aab
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfujo5:ZaHxXMZ6466HtItoSo5
- TLSH T101760A42F223A86EC346D5348419C932A5203F6D47B34DBBFC5CF2B4FA2A5677529E21
- MD5 SHA1 SHA512 SSDEEP TLSH