Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 01:34
Behavioral task
behavioral1
Sample
2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 7.8MB
- Sample260815-by4dpscr6x
- SHA256 e77a4850242060759ef69c14ae3e453119dd125fdd46c51599b4c8461b2de63b
- MD5 44fb00c923872d3e1e3c46273dbd788a
- SHA1 531c6529558431d987d3d3347e1e4e9bb84b1489
- SHA512 971cc43f268e5df25b330c46015416d5ccc69e9c1cf5a9aad0ec67a577435be376a56df36b50fea7a0f4be7c139e1343a9f700a5fb1b5b4c6ce5bc5e590a587c
- SSDEEP 98304:Z3qqUHxqPF4VMNzfVqz83yDydiukLImzFCAgVScLapIW:ZaHxXMNfPAhNzFCAgUccIW
- TLSH T1BD869D16B2E00455D2A98730DF258320A7B17C994FF1C3DFEA6472D55E36BE0BA3A706
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\grpconv.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ByteCodeGenerator.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\proquota.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\rrinstaller.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\takeown.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dfrgui.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\logman.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RunLegacyCPLElevated.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SpatialAudioLicenseSrv.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\AppVDllSurrogate.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\subst.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\userinit.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PresentationHost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\systeminfo.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpupdate.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msinfo32.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\netiougc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xwizard.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\gpscript.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wlanext.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkdsk.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cmdkey.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe -
resource yara_rule behavioral2/memory/5164-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x000e00000001c4e4-5.dat upx behavioral2/memory/5164-470-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5164-2912-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\DlpUserAgent.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.1150_none_57cd52b05a092c6e\r\Windows.Media.BackgroundPlayback.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\r\SpaceAgent.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\UCPDMgr.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-timeout_31bf3856ad364e35_10.0.26100.1_none_895815212ed14bd2\timeout.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\microsoft.creddialoghost_cw5n1h2txyewy\CredDialogHost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-wpr_31bf3856ad364e35_10.0.26100.1591_none_fdef694f47f84aa8\r\wpr.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..auncher-cmdlinetool_31bf3856ad364e35_10.0.26100.1_none_f4339379cb9217a5\pwlauncher.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ngen_exe_b03f5f7f11d50a3a_4.0.15912.100_none_aaf04994419917f0\ngen.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_curl_31bf3856ad364e35_10.0.26100.1301_none_248cf2c6018a558d\curl.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1_none_7020b80d32da4344\diskpart.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.26100.1301_none_d8e83661333da001\finger.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\UwfServicingShell.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1150_none_73d27b280bfbc7a7\iscsicpl.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_57ca55906b66d7b3\SystemPropertiesPerformance.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\r\ShellExperienceHost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-at_31bf3856ad364e35_10.0.26100.1_none_5449f71c20d1e235\at.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\comp.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\showmount.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.26100.1591_none_361f20b3ac5f9b91\nltest.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-containerdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_234860e0e753c908\hcsdiag.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.26100.1_none_d80a0abbc02dc6d0\InstallUtil.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\certreq.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\qprocess.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_cee89c9eae78ac91\ServiceModelReg.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15912.355_none_8633c2a132a5236f\aspnet_regbrowsers.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_080ef735d249ae9a\comp.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.26100.1_none_6286baeedbc54537\LogonUI.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-photoscreensaver_31bf3856ad364e35_10.0.26100.1150_none_07b5cf4f085fe80c\PhotoScreensaver.scr- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.26100.1591_none_62c72aa79c6b13fd\Robocopy.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\MsSense.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.712_none_82c18832efd3e8d9\r\mmgaserver.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.26100.1_none_f306a7a7706ba025\user.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\FESearchHost.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.26100.1150_none_b8bbaaa483060b58\r\adamuninstall.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-regini_31bf3856ad364e35_10.0.26100.1_none_139e8f2156be3ffe\regini.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.26100.1591_none_7fa1f11eafc6c01d\r\wbengine.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-tools_31bf3856ad364e35_10.0.26100.1_none_91672235f58871de\wlrmdr.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..csengine-nativehost_31bf3856ad364e35_10.0.26100.1_none_216e3761f97ed1b2\sdiagnhost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1_none_e42fc57779c55fcd\cmdkey.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.26100.1_none_6bac5cbeaae00b9d\ttdinject.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1_none_f4516e08d8dbd686\w32tm.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..biometrics-trustlet_31bf3856ad364e35_10.0.26100.1150_none_e129c29cb0451e37\BioIso.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.26100.1000_none_c42bc74a0a3c26d8\r\taskhostw.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\NarratorQuickStart.exe 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-gdi_31bf3856ad364e35_10.0.26100.1591_none_4593139f0a8d3490\r\fontdrvhost.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.0.26100.1150_none_0f016472f35d0135\ieUnatt.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-runlegacycplelevated_31bf3856ad364e35_10.0.26100.1150_none_acf35f94a536be18\RunLegacyCPLElevated.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_multimedia-windows-..n-playready-desktop_31bf3856ad364e35_10.0.26100.1150_none_d50cb16c6bb0fec5\r\prproc.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_28167f3f452aef57\r\pcaui.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lua_31bf3856ad364e35_10.0.26100.1150_none_4231ada90cb553fb\consent.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.26100.1150_none_723216da827602dd\mmgaserver.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.26100.1150_none_3a3e93ee89e96c57\r\changepk.exe- 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_44fb00c923872d3e1e3c46273dbd788a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5164
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 8.8MB
- SHA256 ce9a35a2db8c695b455956a1cdbccb1b3e7ca91e0305aea0796d0a071c99c2d5
- MD5 13f45ed55282b6167c031f0abc82fdc2
- SHA1 2b56775512d82800a3068bded8fff599652ab477
- SHA512 c6c22db5e224a38b3f4587ea6b9c9ccbf6b883e2c721d0272c7ad3e1bdf9d7c0eb52c99073df1ce9f8e0d7c75091f010b2c14ac105618735566ea07300c555f4
- SSDEEP 98304:Z3qqUHxqPF4VMNzfVqz83yDydiukLImzFCAgVScLapIfezSC6v2XMHE:ZaHxXMNfPAhNzFCAgUccIEP
- TLSH T1B5969D12B2E44156C1B68335CF669321A7B13C564FF183DFA66472D81E37BE0BA3A316
- MD5 SHA1 SHA512 SSDEEP TLSH