Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 02:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 3.3MB
- Sample260810-cq61ashm2v
- SHA256 c699aac044e723698f000c51621237ec2e7c7ee6caf15bbc2706b5b2e32a9c7c
- MD5 8b3222b420b85919f925ab513d54a989
- SHA1 e42ae1767e0ec892dff7f468a64ba41275716bc8
- SHA512 d1835f1735bd1a14177ef65668d6f880c676411d6a65326fa9f12de63119a1cbf50cec1576418e027bd390a359b242e0a0939296ae6983b75c28aa81b2d6a964
- SSDEEP 49152:3qJtb2Iyz+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH:3nu0oAaldmdmnpH
- TLSH T16FF54A13F1A445A9D066C078CE86D235EB327C4947F1A5EF3280B6D92E77AD07B3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\convert.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msdt.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcconf.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\label.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msfeedssync.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmstp.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setup16.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dpnsvr.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\shrpubw.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systray.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\colorcpl.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\psr.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Taskmgr.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wowreg32.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\UevAppMonitor.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\tpmvscmgrsvr.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.26100.1_none_8c4a868d0582d524\DataSvcUtil.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1_none_b079f7ba2cc824d5\PING.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..utermanagerlauncher_31bf3856ad364e35_10.0.26100.1150_none_29fcc30aa43c0df5\r\CompMgmtLauncher.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..wsupdateclient-core_31bf3856ad364e35_10.0.26100.1591_none_4aa2580f59a05075\r\wuauclt.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-charmap_31bf3856ad364e35_10.0.26100.1591_none_986e62d788c2c027\r\charmap.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\aspnetca.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1000_none_5f95cc5803dfafcd\WMIADAP.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_10.0.26100.1150_none_26313857ae07f88d\r\Eap3Host.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.26100.1150_none_36fd183d90da21cb\immersivetpmvscmgrsvr.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpresult.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\TCPSVCS.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_10.0.26100.1150_none_b5f3ecb264c23d6b\mcbuilder.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.26100.1150_none_0b01ddf21fe9a3f6\r\notepad.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-server-isolation_31bf3856ad364e35_10.0.26100.1591_none_386f0e150ea90546\r\PrintIsolationHost.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_0e2538fcfbcfdda3\certreq.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmplayer.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.26100.1591_none_4345324c74f92366\ctfmon.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.26100.1591_none_99ab5c6b730e7956\CertEnrollCtrl.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iediag_31bf3856ad364e35_11.0.26100.1591_none_f6583c166accd553\iediagcmd.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-storage-refsdedupsvc_31bf3856ad364e35_10.0.26100.1591_none_739bd7d2b0e92fb8\ReFsDedupSvc.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-es-authentication_31bf3856ad364e35_10.0.26100.1_none_49050f53b3863739\EhStorAuthn.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..nfiguration-cmdline_31bf3856ad364e35_10.0.26100.1_none_10a40aea1dac80e8\powercfg.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_fe90da8a8133c864\SystemPropertiesAdvanced.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\SyncAppvPublishingServer.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-credwiz_31bf3856ad364e35_10.0.26100.712_none_41fcc82854bc2b0c\r\credwiz.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15912.0_none_9dcb4fe8bf21aec2\RegAsm.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-uevservice_31bf3856ad364e35_10.0.26100.1591_none_19642579da3d47f4\AgentService.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.26100.1150_none_ced6ba8820394f22\r\fodhelper.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\r\ktmutil.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1_none_096f21018ec4c252\GameBarPresenceWriter.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.26100.1150_none_4e317f44e4f64723\LicenseManagerShellext.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.26100.1_none_9cc92cd303f82ace\wuapihost.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.26100.1591_none_cf86813ad32dd96e\pcalua.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-bootexp_31bf3856ad364e35_10.0.26100.1150_none_6548a7f0b3a3e4e1\BootExpCfg.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_ce938c0efedcde06\r\HOSTNAME.EXE- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_21c930510a00a526\AppLaunch.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.26100.1_none_9187ca465243b700\schtasks.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil_31bf3856ad364e35_10.0.26100.1150_none_684b64ef9fd684b4\fsutil.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..or-native-serverbox_31bf3856ad364e35_10.0.26100.1150_none_0ba6100513fbb80d\RMActivate_ssp.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sethc_31bf3856ad364e35_10.0.26100.1591_none_fe803a2025222595\r\EaseOfAccessDialog.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.26100.1150_none_092b86d80d75b9b6\cleanmgr.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.26100.1150_none_b68ce2ecb8338725\ConfigSecurityPolicy.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\SearchIndexer.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-setup-support_31bf3856ad364e35_11.0.26100.1591_none_a548c43e37f4b89b\r\ie4ushowIE.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-proquota_31bf3856ad364e35_10.0.26100.1150_none_c3ae484e424f106c\proquota.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.26100.1_none_768f227b459e9f20\rasdial.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\r\SyncAppvPublishingServer.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmpnss-ux_31bf3856ad364e35_10.0.26100.1_none_b4b86b7122033aff\wmpnscfg.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskusage_31bf3856ad364e35_10.0.26100.1_none_b917a4fda287fde2\diskusage.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8b3222b420b85919f925ab513d54a989_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.2MB
- SHA256 68c968f7576b1717c5ba6dbd7604d81f82a06a1c6110fc7241e1f7a202118f8c
- MD5 7f8e58bb2c0099be2cf31ff28db3fb8d
- SHA1 07f5572ccdf1b8c531f37ca0503b44dd38fbf4a2
- SHA512 760b9ee6893800af3499d0387f2b997941663471e8bb544c226e6b47281623d40daa504adf3812cf587b2863b83e747276c922324465a77a56d7dedab5b0ff38
- SSDEEP 49152:3qJtb2Iyz+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyQ/ezSC6vUzPvMA:3nu0oAaldmdmnp0ezSC6v2XMHg
- TLSH T1B7165B13F16842A6D066C079CE829665EB323C4947F195EF3281B7E93E33AD1773A721
- MD5 SHA1 SHA512 SSDEEP TLSH