Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/08/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
- Size 5.2MB
- Sample260816-ead1payfrd
- SHA256 0c6e817b0c0866883f9645def796369dbe79f246d153ae8e8a9d1441eaf93fac
- MD5 c532d14fe722303310cf6afeebf83420
- SHA1 c18ab1385b64b582aa13de2bc670b617f48e1741
- SHA512 005b1118704f50dedec2c624e84adcd0aaf2e22f52116c93077f0ffe348d3acc767a90fbc173ea81ec1957ef1ec746ac5498cf404cc7a393fb041f02a4ac3b0c
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4ON:yevoirV0t/iLwHft8vAA
- TLSH T1F5463911764A4FACC59FD474868649665A237C8A0F71ABDF0180BF393E7AAF41F38217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cipher.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\clip.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\fixmapi.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\appidtel.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dxdiag.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSa.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\Dism.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\autoconv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\bitsadmin.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cttune.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RmClient.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dplaysvr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tree.com 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dialer.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RdpSaProxy.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemUWPLauncher.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tcmsetup.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wextract.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\eventvwr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPDCT.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mspaint.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\write.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmdl32.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WerFault.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\certutil.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\gpresult.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\replace.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dccw.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\odbcad32.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\regedit.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\7-Zip\7z.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-u..snotificationbroker_31bf3856ad364e35_10.0.19041.153_none_42505a6de732f7ca\MusNotification.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\winhlp32.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3594628932065f23\r\wevtutil.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..ssociationframework_31bf3856ad364e35_10.0.19041.746_none_88402ba139c8967e\dasHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_6c221eaccd6c91ae\msinfo32.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.1_none_fefb8187fb0ed9be\GamePanel.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-convert_31bf3856ad364e35_10.0.19041.1266_none_119b1e415d838a28\f\autoconv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\imecfmui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..cymanagerbrokerhost_31bf3856ad364e35_10.0.19041.746_none_5cc81a54cf095c95\r\EASPolicyManagerBrokerHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\f\relog.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_10.0.19041.1_none_5d7644a9644fd29d\ctfmon.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..cation-creduibroker_31bf3856ad364e35_10.0.19041.746_none_a8b46aaa6c07ca3d\f\CredentialUIBroker.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorQuickStart.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\f\UsoClient.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\f\SndVol.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_98f5b8d3db68981e\dcomcnfg.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\r\tttracer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..lity-eoaexperiences_31bf3856ad364e35_10.0.19041.153_none_c283d2cf01b0b7d8\r\EoAExperiences.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..alcontrols.appxmain_31bf3856ad364e35_10.0.19041.1266_none_1833f07ce0c90b68\WpcUapApp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-international-unattend_31bf3856ad364e35_10.0.19041.1_none_805f7a2ac157fb08\MuiUnattend.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.746_none_6c16d1714d60fddf\f\mspaint.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\spaceman.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\UNPUXHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.1_none_37f2e74a0020dc93\pcaui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ndowmanager-process_31bf3856ad364e35_10.0.19041.746_none_11e04cec24452336\dwm.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-gdi_31bf3856ad364e35_10.0.19041.1165_none_28f87d0444103fde\f\fontdrvhost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.1_none_f830216e59eee182\OOBENetworkCaptivePortal.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.19041.546_none_3f1cc1d15da468cf\tracerpt.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\1ea4214236e5d7010e9700001815341f.hvsiproxyapp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.19041.844_none_f3894559140c31d7\imjpuexc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_8a8440f738abd1b9\f\wmplayer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..sition-uicomponents_31bf3856ad364e35_10.0.19041.1151_none_4e193eb76ed5f8cb\wiaacmgr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.1288_none_a518f9eb1ab503d0\r\hvax64.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.19041.789_none_3136b8d712da0334\XblGameSaveTask.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.1_none_bc34aea0c10c4a99\setupugc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_eb6597ac99d11603\SpatialAudioLicenseSrv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.19041.1151_none_21d0a68ccdc67be8\f\wusa.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1_none_d1bc032a24676029\newdev.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sethc_31bf3856ad364e35_10.0.19041.746_none_4b0e3418084b5511\sethc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..ectxdatabaseupdater_31bf3856ad364e35_10.0.19041.84_none_2d21e26a18d595c7\f\directxdatabaseupdater.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\f\omadmprc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ed-chinese-moimeexe_31bf3856ad364e35_10.0.19041.1_none_9afd0cb7be0e8af9\ChsIME.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-ui_31bf3856ad364e35_10.0.19041.1_none_ac65d58626f4027c\efsui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-shellhost_31bf3856ad364e35_10.0.19041.746_none_f47187f881cbaf7d\r\sihost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.1266_none_21c0be7c0dad3632\f\UNPUXLauncher.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.1_none_570d39e810ac0f64\WmsSessionAgent.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchFilterHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..eldebugger-recorder_31bf3856ad364e35_10.0.19041.746_none_4cb1ff2aa122b5dd\f\tttracer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.19041.906_none_066336a1b904a848\r\taskhostw.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.746_none_4b0a936d86cdd479\windeploy.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\r\ImeBroker.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..sktop.appxmain.root_31bf3856ad364e35_10.0.19041.1266_none_3e00d223332897b8\f\SearchApp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.19041.1081_none_8b145c40e6c6207f\winrshost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\msil_inspectvhddialog6.3_31bf3856ad364e35_10.0.19041.1_none_7dca23f8be8c25d6\InspectVhdDialog6.3.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.19041.1202_none_574a25a5ee347454\f\memtest.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mdmagent_31bf3856ad364e35_10.0.19041.1266_none_b9c280a4d350d170\r\MDMAgent.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\b6c0024236e5d701ea9600001815341f.eshell.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_4de8bd849baaa96f\r\WerFaultSecure.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 5.8MB
- SHA256 9043904750d0f17047c697a269d71fd426bd1d9a34dbf5b734f30c864006de21
- MD5 0f30141df229306ea878d98026199d67
- SHA1 48b9f3c52fba10288ab6bf8f75f771e34d87b004
- SHA512 a3fdef184aee67a34a849b2d5a3c0478a08c5d007cb2519a8243ef8bf77146ad5c51fc914217a7be13bd269ffb81025f1977725c832d1aed06d7c0640d737bf8
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4OJ:yevoirV0t/iLwHft8vAYjom
- TLSH T18656391176594FACC49FC474868649669A237C8A0F31ABDF0280BF393E7AAF45F35217
- MD5 SHA1 SHA512 SSDEEP TLSH