Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
- Size 568KB
- Sample260812-2gdd3afb74
- SHA256 a820d71a09512dc0d901b0e138afe82df68ff428ae1b8897d52d512699e068ab
- MD5 4112d1da72a366b176ae3ac0f96eb1c2
- SHA1 3952383a557776d0238c350e6086490832f603ee
- SHA512 e19361bd2368c5e9db939fd9548f11c29eabb9f36b68977def675d41e71be9dfae046ae5c348ffc7f7a4d5ebeabaecf56d81b1403d41f9e80da7f90b1351ae20
- SSDEEP 6144:4jM2GtsDWwfLAf68fzKgtVovqN+7/buOjEPBY51q35D8lwJcuS6W9ejMD8iZIfN1:kCwfMfmgtV8qN+85Y5s8l3t5v4JAdGyA
- TLSH T15BC4AE29F7E098F1E877D13889E69613EA32B861072099DB639497592F333D05E3F706
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\Utilman.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\Netplwiz.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\tasklist.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\Windows.WARP.JITService.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\fltMC.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\OpenWith.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\rundll32.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\ftp.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\makecab.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\mobsync.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\svchost.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\SystemPropertiesRemote.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\label.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\mmc.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\svchost.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\ARP.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\ctfmon.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\msiexec.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\relog.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\explorer.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\icacls.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\sxstrace.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\format.com- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\rdrleakdiag.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\autoconv.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\certutil.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\CredentialUIBroker.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\mcbuilder.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\openfiles.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\stordiag.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\fontview.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\show_third_party_software_licenses.bat- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Windows Media Player\wmpshare.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-externaldictionary_31bf3856ad364e35_10.0.19041.1_none_f28c973357fcbd08\IMEWDBLD.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.19041.1202_none_42d3a7d52bcb0f8d\f\WorkFolders.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\f\SgrmLpac.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\SenseSC.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..dateclient-api-host_31bf3856ad364e35_10.0.19041.1266_none_149b57f8509ce672\wuapihost.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.19041.546_none_380485edeba9f4c4\SgrmLpac.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-icm-ui_31bf3856ad364e35_10.0.19041.746_none_22a6ac8933ff6d5e\colorcpl.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\GamePanel.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_b1e0044e8cab889e\setupugc.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pickerhost_31bf3856ad364e35_10.0.19041.1_none_639e78e5edb8f409\PickerHost.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasclienttools_31bf3856ad364e35_10.0.19041.1_none_2f8c879e7c6f8b16\rasphone.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_f79dcf01d5a416bd\msra.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.1288_none_e25de9f9d964cdad\f\conhost.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.928_none_b321f2c2ab7710a2\sdbinst.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\SearchFilterHost.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.1_none_04930b2bd1f9871f\Microsoft.AsyncTextService.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\ShellLauncherConfig.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1_none_8298e4b5b7fd2c26\iexplore.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..alservices-webproxy_31bf3856ad364e35_10.0.19041.1_none_e768b85cf7ad062e\TSWbPrxy.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..te-musnotifyiconexe_31bf3856ad364e35_10.0.19041.1266_none_adfc223229a335a6\r\MusNotifyIcon.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.19041.964_none_9a882af90ea09cc3\r\scp.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_949b3f6674b404fa\f\PasswordOnWakeSettingFlyout.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\instnm.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.19041.84_none_8ea6a37043f4ae90\ClipUp.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..t-bytecodegenerator_31bf3856ad364e35_10.0.19041.1081_none_5500d10e49b43346\ByteCodeGenerator.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_43c494653a7536d0\wiaacmgr.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.19041.1_none_c10c5c59091a9a90\fc.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.19041.746_none_be98bb8265bc211a\mmgaserver.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.19041.1_none_6e398157aa492263\unregmp2.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\f\dwm.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-sharedlibraries_31bf3856ad364e35_10.0.19041.1_none_c6da8048542fddc7\iisrstas.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..verycenter-platform_31bf3856ad364e35_10.0.19041.964_none_21209b01f08afd33\SystemResetPlatform.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\SpeechModelDownload.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\UNPUXLauncher.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\pcaui.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.19041.1_none_856b4f50911c6560\DmOmaCpMo.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapisetup_31bf3856ad364e35_10.0.19041.1_none_1fe438473a878c5c\TapiUnattend.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.19041.1_none_69cd9c22cfcf9358\plasrv.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.1_none_291e1d3069ab2f3a\diskpart.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..ortingcompatibility_31bf3856ad364e35_10.0.19041.264_none_dc8146375466099a\DWWIN.EXE- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpksetup.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.19041.746_none_49c7c9a4b745444e\r\PhotoScreensaver.scr- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-starttiledata_31bf3856ad364e35_10.0.19041.264_none_6ea6dfb6393e5f06\DataStoreCacheDumpTool.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1052_none_b39097e5dc722fb4\f\GamePanel.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.746_none_49d38afb2289b178\f\netiougc.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Taskmgr.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..hreshold-adminflows_31bf3856ad364e35_10.0.19041.1023_none_9583d52fd3076014\SystemSettingsAdminFlows.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.19041.1_none_d1ffdc3927836528\WmsManager.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_windows-shield-provider_31bf3856ad364e35_10.0.19041.84_none_9d98e005fb7852ca\f\SecurityHealthService.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\r\spaceman.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_a64f417ee38bbfd9\hh.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_ff72825025776920\msiexec.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.19041.746_none_8a469514405342ff\f\PasswordOnWakeSettingFlyout.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\f\XblGameSaveTask.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Microsoft.ECApp.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\qappsrv.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.19041.1_none_af9a68f0cc4d15fb\systeminfo.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe File created C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe- 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_4112d1da72a366b176ae3ac0f96eb1c2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_redl.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4432
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 1.1MB
- SHA256 9b820208ed2ada27a63baac41b7d18b96a7aebd2fd00817187cd0cb4c52ba1b9
- MD5 5b22e355801df39bacfc62571c089769
- SHA1 fff0ac2c130c3136c15975e939e3ea7394b4b955
- SHA512 fa8b80b43e633fd6431d5a94241f5dc3f2fefe5581ae5a12e4b4f110ba53113432e4f438243ca0880d54d17195a01439fd3b2042a47cbf40d7b5068ebb88eb09
- SSDEEP 12288:kCwfMfmgtV8qN+85Y5s8l3t5v4JAdGyeXZNYVLeyUji0h90ZD0wxpGZIVuKrHsd:kaftf3Idd5QJ+Ry0Le5ji0hmxNrMd
- TLSH T115356D26F6B48771D073C0B9C5D2A65AEE72344217308ACB5395D76C2F277E28A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH