Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 00:56
Behavioral task
behavioral1
Sample
2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 10.7MB
- Sample260810-bakaxsdc68
- SHA256 bda3f2065953dc55c726d4193374a258ae68cee893af2ea0d9e129ed49d0a0ab
- MD5 5ef7cc7d8fe227d7ccdfd4ec318a672b
- SHA1 b23228a4638d8bb7315e2b6c67d5353f09e1c7cd
- SHA512 e4340d9f1dffea944c1a06524ce4ac3d1f6cbc091e910cab99ca47242554d779573725637303e191b622dd735c19d59791e5a1f837894a5f89d240db59df4ed6
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfwWQtZ/K0tGOFWVRuLftCTP:ZaHxXMZ6466HtItoKWyZ/K0ttYVAATP
- TLSH T16DB61903F253545ED246D53489298A32A6213F6D47F358FFB858F2E4EA365E33638B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setx.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DWWIN.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ieUnatt.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\expand.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\net1.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\finger.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\recover.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Register-CimProvider.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\control.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/2872-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001b85a-5.dat upx behavioral2/memory/2872-434-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2872-2909-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\uninstall.cmd 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECECEC7E-D0D4-455B-8F24-7676AF0A59FB}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\dotnet\dotnet.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.26100.1_none_620ce84c3dbaadff\fsquirt.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..on-filedialogbroker_31bf3856ad364e35_10.0.26100.1150_none_76334e5b2ee0ae62\FileDialogBroker.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ropertiesprotection_31bf3856ad364e35_10.0.26100.1_none_60a5ff2e85104e26\SystemPropertiesProtection.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\print.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\EdmGen.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..e-licensing-service_31bf3856ad364e35_10.0.26100.1591_none_20144fc41cfe40b9\ClipDLS.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scrnsave_31bf3856ad364e35_10.0.26100.1150_none_7d26f17a8a4ec06a\scrnsave.scr- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.26100.1742_none_b6069a8cd10e9cfa\sppsvc.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\tsdiscon.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certutil_31bf3856ad364e35_10.0.26100.1591_none_5b99ad6617c42c0b\r\certutil.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_c9d83dab422b920f\r\dxdiag.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\LicensingUI.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\charmap.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-autofstx_31bf3856ad364e35_10.0.26100.1591_none_4acfacd4985a9f74\autofstx.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.26100.1_none_95cced994cad782c\BackgroundTransferHost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_139e8f2156be3ffe\regini.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wlan-extension_31bf3856ad364e35_10.0.26100.1_none_012b81e0c046e57c\wlanext.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\SearchHost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\adaminstall.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1150_none_acd0c33b64bc3fcf\iisrstas.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\r\hcsdiag.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicepairingapp_31bf3856ad364e35_10.0.26100.1_none_76e6b4609ef9e4b1\DevicePairingWizard.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.26100.1_none_3ea069de9ed32ac7\msra.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\WebExperienceHostApp.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\ApplySettingsTemplateCatalog.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgusr.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.26100.1150_none_05da7b3a4b13ee64\TapiUnattend.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-restartmanager_31bf3856ad364e35_10.0.26100.1_none_877dba7dc10bf8a0\RmClient.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.26100.1591_none_66584740e63efa06\r\InputSwitchToastHandler.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mschedexe_31bf3856ad364e35_10.0.26100.1_none_dc91fd1f1af84c4d\MSchedExe.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1_none_d1adc81249f528d5\winrm.cmd- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\ROUTE.EXE- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\dtdump.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\r\diskpart.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..up-deviceencryption_31bf3856ad364e35_10.0.26100.1591_none_7622b05853a7428c\r\BitLockerDeviceEncryption.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\mavinject.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.26100.1591_none_161bc21b2130ea78\r\WerFaultSecure.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msdt_31bf3856ad364e35_10.0.26100.712_none_51f923c23ace47fd\msdt.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\r\LockScreenContentServer.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\WmsSessionAgent.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseSampleUploader.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.26100.1591_none_80585f5752dd6955\EoAExperiences.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-optionalfeatures_31bf3856ad364e35_10.0.26100.1150_none_024e4ac09d98d886\OptionalFeatures.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ioningsecureprocess_31bf3856ad364e35_10.0.26100.1150_none_32bd5b6fcfab5b78\psp.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.26100.1591_none_b7c9eb31fbd37700\r\SpeechUXWiz.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..packagedcwalauncher_31bf3856ad364e35_10.0.26100.1_none_ea8223e29a7906a5\PackagedCWALauncher.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.26100.1591_none_e06d5ce38536ffdd\r\colorcpl.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe- 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5ef7cc7d8fe227d7ccdfd4ec318a672b_akira_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 11.6MB
- SHA256 280ff03b419ef491c40eae0ecc84679bafda6f8255edb28ec0a49107277d8b53
- MD5 6da71e95018b6c5a1d9d1ee59b65863b
- SHA1 1123504414a7f391b9deaa0cacad026f48e7e602
- SHA512 bc35f8f1fedcfeb5d4a2d046dcd59fbc95d811fae18237b9b1295444a2715ab74b48f1d462347bd8cc3ffa5de6635cfc3e431ddfc332d29061a360c61feec73c
- SSDEEP 98304:Z3qqUHxqPF4VMNP6TUyL6HtItjkgcfwWQtZ/K0tGOFWVRuLftCTMezSC6v2XMHE:ZaHxXMZ6466HtItoKWyZ/K0ttYVAATLf
- TLSH T1D2C63A02F263546ED256D134C5198A32A6213F6D47B358FFB848F2E4EE365E37638B21
- MD5 SHA1 SHA512 SSDEEP TLSH