Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 00:52
Behavioral task
behavioral1
Sample
2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 6.4MB
- Sample260810-a8jllssscw
- SHA256 521fcae814e5d317ce8e6ade4217f786880f840997ccd9398e0555a28f2d3eee
- MD5 7e96a87d1df10f22f0ab2379d90e783a
- SHA1 197be66c7cdf4ceb8f7f08f4c8a4dd74709a0d43
- SHA512 3de9015f57a61b853913df6f9f3c30e79a4f3b7229498de0a32df93289592512348c26d481e93f1082762f79fc91cc4d4b62d5c16cabd27af6660598bb5c336c
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDFzpYqT:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfP
- TLSH T11966F846F223A86EC346D9348418C932A5203FBD57B30DBBFC5CF1A4FA2A5677519E21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\tree.com 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\help.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\taskkill.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\schtasks.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmmon32.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\find.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\at.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PATHPING.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TapiUnattend.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/3972-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000d00000001c614-5.dat upx behavioral2/memory/3972-647-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/3972-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\Uninstall.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.26100.1150_none_25a595b3a76ab6cf\ImeBroker.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-k..el-la57-setuphelper_31bf3856ad364e35_10.0.26100.1150_none_6e7a8527eaac2aa2\la57setup.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.26100.1591_none_8b74ec1a688877ac\r\NcsiUwpApp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-processmodel-cpt_31bf3856ad364e35_10.0.26100.1_none_a7c632dbdc1d61bb\w3wp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1150_none_fb078fe8106f7572\r\cmmon32.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.26100.1591_none_bbcf7a15a36f8b3f\r\runonce.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_4.0.15912.0_none_75b001d640e3113b\aspnet_compiler.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicesetupmanagerapi_31bf3856ad364e35_10.0.26100.1150_none_139d0992bdcc4113\DsmUserTask.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..oler-filterpipeline_31bf3856ad364e35_10.0.26100.1591_none_c76d94b08b6db4ab\printfilterpipelinesvc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-refsutil_31bf3856ad364e35_10.0.26100.1591_none_86770ed0df6bb53c\r\refsutil.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\r\BioIso.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-lkg_31bf3856ad364e35_10.0.26100.1742_none_3c72368675eae921\LKG.Search\FESearchHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\msra.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..crosoftedgedevtools_31bf3856ad364e35_10.0.26100.1150_none_4b9ba76194d03300\MicrosoftEdgeDevTools.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ime-eashared-ccshared_31bf3856ad364e35_10.0.26100.1591_none_71da000f2a392039\IMCCPHR.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\r\qappsrv.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ARP.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\SgrmLpac.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_ccee7580f3b9f072\MpCmdRun.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.26100.1742_none_934daed75bcea2ea\vmcompute.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.26100.1591_none_2204fa419ae7b594\msinfo32.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\r\tpmvscmgr.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onagent-proxyobject_31bf3856ad364e35_10.0.26100.1150_none_ff5cc17171576ed5\RdpSaProxy.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-xcopy_31bf3856ad364e35_10.0.26100.1_none_5fe953095cd8da00\xcopy.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.26100.1150_none_b68ce2ecb8338725\ConfigSecurityPolicy.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_7a109607cfe12f00\print.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.26100.1_none_af4d21cdb9ffe687\mountvol.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.0_none_901f30f8c2af7d1e\aspnet_regbrowsers.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_eventviewersettings_31bf3856ad364e35_10.0.26100.1_none_fc402ab9a0a08082\eventvwr.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..me-japanese-setting_31bf3856ad364e35_10.0.26100.1591_none_58449d9961468d2f\r\IMJPSET.EXE- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.26100.1591_none_53c210db32c306cd\r\PickerHost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\mofcomp.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.26100.1591_none_cfa6fd46757cb5b5\r\dwm.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tpm-tool_31bf3856ad364e35_10.0.26100.1591_none_99f9c6049c838786\TpmTool.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.26100.1_none_f0f02bfb8c3b8acf\mtstocom.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\WSManHTTPConfig.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.26100.1591_none_f11dd8b719f1a6f5\r\drvinst.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\browser_broker.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\r\WSReset.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lipboardredirection_31bf3856ad364e35_10.0.26100.1591_none_9d960bc9bb2901f9\r\rdpclip.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.26100.1_none_66689223fd72e96f\cmdl32.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.26100.1742_none_200d0ee10b67fc30\nvspinfo.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.26100.1150_none_4c8f142bf82279e1\dcomcnfg.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..structureexecutable_31bf3856ad364e35_10.0.26100.1591_none_93c87ba6060f19c7\r\unlodctr.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.26100.1150_none_713524eb211332eb\r\ReAgentc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\AppResolverUX.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate-core_31bf3856ad364e35_10.0.26100.1150_none_d0d1e07b8681fa6b\dllhost.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.26100.1150_none_80f34faace9aed01\r\ChsIME.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.26100.1150_none_6ddb91cebfef2c08\repair-bde.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\dtdump.exe- 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_7e96a87d1df10f22f0ab2379d90e783a_akira_amadey_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 7.4MB
- SHA256 e5f4dd59f8d71bcdd6240e65900fd7b09fde36a676f489fafe517452ec58b9d2
- MD5 6b4c46b24f985cb322018f76490371d9
- SHA1 dfe1f61eb3f511f9c183ce7a7e02389c40fa1472
- SHA512 001b80ce82396a8e21a414178492848277eb31d5326dc7159501c67b3291d0a272358e62e438eb2808b80feb3bcf86bc393f69c1f9bffd72660ecd5537e671a0
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfMezSC6v2XMH4:ZaHxXMZ6466HtItoxL
- TLSH T1D6761A42F223A96FC246D5348419D932A5203B6D47B34CBBFC4CF2B4FA2B5676529F21
- MD5 SHA1 SHA512 SSDEEP TLSH