Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 00:42
Behavioral task
behavioral1
Sample
2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
- Size 3.5MB
- Sample260811-a2edbabe87
- SHA256 a9b97e1e7b737d016e026a8c0dcf9583cd887b668ed3b6db7e6c9eace16cfb5f
- MD5 bdd53a812d9aa60a78ee27567c0eb7dd
- SHA1 f68212430f83c03dbfd4e929f2988b7f972b5cc0
- SHA512 6ee960dd3c3a637c20c57f0b1c37aaa3e0b3aced23440abdf0a17765b86e62317276c75ee60d2f843ce54aec0c7cda67b2db04664d6407fa05544accd08f972c
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qDO:Z3qqUHxqPF4VMNQ
- TLSH T1BF068447F242D88BE294D6348915C63292617EBD87B354EFFD6CB18CF63E5A33528A01
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sort.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\instnm.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\user.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\iscsicpl.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netbtugc.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TokenBrokerCookies.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrs.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ddodiag.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmInit.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wermgr.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\lodctr.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TpmTool.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mfpmp.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\OposHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\setupugc.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mode.com- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/2760-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000200000001b313-5.dat upx behavioral2/memory/2760-762-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/2760-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javah.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIdentity.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\diskperf.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.26100.1591_none_5161e6c7fe274864\fixmapi.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rundll32_31bf3856ad364e35_10.0.26100.1591_none_7e19f7088f522c23\r\rundll32.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1150_none_04bfb5d145d6cf47\diskpart.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..agement-coredpussvr_31bf3856ad364e35_10.0.26100.1150_none_373500bc10348045\coredpussvr.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpq.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp_31bf3856ad364e35_10.0.26100.1742_none_b6069a8cd10e9cfa\r\sppsvc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.26100.1150_none_51a2aa17b537a668\r\svchost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.26100.1591_none_9a435addc0403fd6\r\regedit.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.26100.1150_none_f6f8f37a2d4c3113\rdrleakdiag.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msaudittools_31bf3856ad364e35_10.0.26100.1_none_1ecd646959af4e74\auditpol.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.100_none_bcd933e3a6b2aaa4\mscorsvw.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.26100.1591_none_986ba09695018480\r\ApplySettingsTemplateCatalog.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-browser-brokers_31bf3856ad364e35_11.0.26100.1150_none_160ad4e2bcc0210f\r\browserexport.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1150_none_e81654ffadf307a4\dcdiag.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\r\mqtgsvc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.26100.1150_none_22d7b78874fa20b2\r\AppHostRegistrationVerifier.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.26100.1_none_1831c57751bfb3cc\aspnetca.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.26100.712_none_f5f8369ba361b124\r\msiexec.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.26100.712_none_1c98fc309bb195c5\NetCfgNotifyObjectHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\r\BioEnrollmentHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ielowutil_31bf3856ad364e35_11.0.26100.1150_none_e61570904a993a97\ielowutil.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-prompt_31bf3856ad364e35_10.0.26100.1_none_ed0315824c80c112\fveprompt.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1738_none_a5031b637767a4e7\poqexec.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.26100.1150_none_38bc9b32583c1c82\convert.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.26100.1591_none_f467d2d98b46d418\r\mighost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\r\vds.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseIdentity.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\r\AppVDllSurrogate.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dataexchangehost_31bf3856ad364e35_10.0.26100.1301_none_8550d029188c257c\r\DataExchangeHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.26100.1591_none_e9f27dc23b0bf8db\r\FileHistory.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..e-client-ui-wsreset_31bf3856ad364e35_10.0.26100.1591_none_6237f51eb608e6f4\WSReset.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.26100.1591_none_41b5bdf47d61c05c\SecurityHealthHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.26100.1591_none_9923bdb86c8e5db2\r\pnputil.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\sessionmsg.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bioenrollment.appxmain_31bf3856ad364e35_10.0.26100.1591_none_9c264eeaa60fc0ca\BioEnrollmentHost.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\relog.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.26100.1455_none_b184dc3c337d380b\wmpshare.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.26100.1591_none_77f3b6be3e383e20\r\imecfmui.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\r\PinningConfirmationDialog.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.26100.1591_none_1f650d1288a260be\UserAccountControlSettings.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_7b25a93731217002\r\sdbinst.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.26100.1_none_2236fe932b70aa37\dccw.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\dispdiag.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..-remoteapplications_31bf3856ad364e35_10.0.26100.1591_none_ddd035314c6868c8\r\rdpshell.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\r\curl.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-control_31bf3856ad364e35_10.0.26100.1_none_965fa19e130a6ef2\control.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\forfiles.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-managedwindowsvm_31bf3856ad364e35_10.0.26100.1591_none_4c3489b778790277\ManagedWindowsVM.exe- 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_bdd53a812d9aa60a78ee27567c0eb7dd_akira_cobalt-strike_elex_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 4.4MB
- SHA256 b48f9f6c6b73f0304f4f311d722b293196323611da0b59da5ab5dbabbd97f9d7
- MD5 f2edc54777bfb4d61cfa8708dfd36318
- SHA1 0f58dc8558790347e44aa28c678703a74b61a574
- SHA512 42182ec35e7890f111a903b5ee29af6b4913388561ce3f8e19a20c0ade64b6699e31b60b79773d6e55762d96b3197a16fa8aa8eca09e096f088ff612b1f5eb69
- SSDEEP 49152:ZD6gqIelOVDTtQY6SoNtaUJ6fUnHpclbwbWAaJiwmqTjcoKVMNuYFMq2qD//ezSi:Z3qqUHxqPF4VMNBezSC6v2XMH6
- TLSH T1AA26E542F212C95BE195D134C855D632A6213DAD87B344EFFD2CB29CFA3B2A36538B11
- MD5 SHA1 SHA512 SSDEEP TLSH