Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 03:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
- Size 5.2MB
- Sample260816-ead1payfrd
- SHA256 0c6e817b0c0866883f9645def796369dbe79f246d153ae8e8a9d1441eaf93fac
- MD5 c532d14fe722303310cf6afeebf83420
- SHA1 c18ab1385b64b582aa13de2bc670b617f48e1741
- SHA512 005b1118704f50dedec2c624e84adcd0aaf2e22f52116c93077f0ffe348d3acc767a90fbc173ea81ec1957ef1ec746ac5498cf404cc7a393fb041f02a4ac3b0c
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4ON:yevoirV0t/iLwHft8vAA
- TLSH T1F5463911764A4FACC59FD474868649665A237C8A0F71ABDF0180BF393E7AAF41F38217
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\Magnify.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\setup16.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tracerpt.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\hdwwiz.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\notepad.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\comp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\LaunchWinApp.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wiaacmgr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\winrshost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\sdbinst.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\tttracer.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\credwiz.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\net.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wusa.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\iscsicli.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\HOSTNAME.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\backgroundTaskHost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dllhst3g.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\nslookup.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\choice.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\provlaunch.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\unlodctr.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\w32tm.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\UserAccountBroker.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\ThumbnailExtractionHost.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\mavinject.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\cleanmgr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\efsui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\wbem\WMIADAP.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\UnblockRedo.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender\MsMpEng.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Internet Explorer\iexplore.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseNdr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender\mpextms.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.26100.1301_none_9624bcf361cbb3f2\ntprint.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_netfx35cdf-csd_cdf_installer_31bf3856ad364e35_10.0.26100.1_none_f9312521dc249ba4\WFServicesReg.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.1150_none_2a04d71b9e7ba19d\mspaint.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.26100.1150_none_d6b9ea087315f389\r\sessionmsg.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1591_none_6c3d16dfebe198e3\SndVol.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_200ace4b24b1d248\chkntfs.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\mmc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..structure-minkernel_31bf3856ad364e35_10.0.26100.1_none_e03d543c53b702b7\perfhost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sharedfoldersui_31bf3856ad364e35_10.0.26100.1_none_bf65878ace780f5e\shrpubw.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Win32WebViewHost_cw5n1h2txyewy\Win32WebViewHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.26100.1150_none_a0f2e25475ab99da\SystemUWPLauncher.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ribbons_31bf3856ad364e35_10.0.26100.1150_none_249c3478d7e5d3ca\r\Ribbons.scr- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..ing-platform-client_31bf3856ad364e35_10.0.26100.1591_none_a525938a63d6ed42\r\licensingdiag.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-edge-webview_31bf3856ad364e35_10.0.26100.1_none_8fe1c356f34a19ca\msedgewebview2.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\DlpUserAgent.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-gaming-xbox..e-service-component_31bf3856ad364e35_10.0.26100.1591_none_ef25a80363f3d9ea\r\XblGameSaveTask.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\chcp.com- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ckgroundmediaplayer_31bf3856ad364e35_10.0.26100.712_none_685cc408c767126a\Windows.Media.BackgroundPlayback.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mystify_31bf3856ad364e35_10.0.26100.1150_none_8bf8eb890f472d80\Mystify.scr- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.26100.1150_none_5952ab67e391cc12\r\ofdeploy.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.712_none_95c89fce0cf184aa\RMActivate_isv.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-dtc-runtime_31bf3856ad364e35_10.0.26100.1150_none_b53a535c0fece405\r\msdtc.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..temcompareutilities_31bf3856ad364e35_10.0.26100.1_none_fdba4ce39de8ec9f\comp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.26100.1150_none_3d037cdb2138716c\r\WmsSessionAgent.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-ilasm_exe_b03f5f7f11d50a3a_4.0.15912.146_none_57dbe416963fa154\ilasm.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay8-payload_31bf3856ad364e35_1.0.26100.1_none_11a8c65c8f61d5fb\dpnsvr.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.26100.1591_none_3f72725b5aa2e9e7\r\TokenBrokerCookies.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.26100.1591_none_3bb2eaeeb6f37532\r\dtdump.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_594e71c0d6ce5e62\AppVDllSurrogate.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_comsvcconfig_b03f5f7f11d50a3a_4.0.15912.0_none_48717892bcec72f7\ComSvcConfig.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_ed74a23929c34603\r\explorer.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\cmd.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.26100.1591_none_26ccc1e3ca6360b3\r\cmd.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\AssignedAccessLockApp.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-setup_31bf3856ad364e35_10.0.26100.1150_none_49db19f88674c270\unregmp2.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\TrustedInstaller.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.26100.1_none_a518656df7c165fb\SenseAP.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-time-tool_31bf3856ad364e35_10.0.26100.1150_none_88f06bccebd86289\w32tm.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.26100.1591_none_1dc1d4ed10ca2d5c\r\pcaui.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.26100.1_none_0a6a82dd5aa9d087\odbcconf.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndkperf-setup_31bf3856ad364e35_10.0.26100.1150_none_862cccb1155d1695\NDKPerfCmd.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-shell-previewhost_31bf3856ad364e35_10.0.26100.1_none_4a85b7d59dcc025f\prevhost.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.26100.1591_none_495d0e173be5ed63\r\SpeechRuntime.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sigverif_31bf3856ad364e35_10.0.26100.1_none_b88d2cbd63eb3d30\sigverif.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.26100.1_none_fcf0e4a9852b11e5\ssh.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.26100.1_none_b94f0eb8a758822f\AddInUtil.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_013d8d7d527fe5d5\compact.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.26100.1150_none_c83b3d886b00dded\r\ieinstal.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..-commandline-dsdiag_31bf3856ad364e35_10.0.26100.1_none_ed041165ae384870\dcdiag.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-gaming-ga..rnal-presencewriter_31bf3856ad364e35_10.0.26100.1150_none_9e0e1ec5a1c14e55\GameBarPresenceWriter.exe- 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_c532d14fe722303310cf6afeebf83420_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.2MB
- SHA256 d26d411502b51b949ca0b191c7182f322e136be17e512e4929d50b729e208000
- MD5 1d6b64fa5f4fcf09c37241aba636e03a
- SHA1 92cfbec6454792d2bfc2e3d1cad59dc8d1f7cde1
- SHA512 54669c77c436173c58634f8531ad777401ee3e4656d71ceca523182b9c8c37db76e27f06f94963f580e5c15867849170894a3398e404402170ec0a9d0ab2ccca
- SSDEEP 49152:yZQZCsnkXBIuRmtoYsj3cUgnDIAVx6IG1jycwgiLwKAdL+clBpDr8vsiIPhsZ4OK:yevoirV0t/iLwHft8vAxezSC6v2XMHj
- TLSH T14666281176594F6DC49FC474C6864966AA237C8A0F31ABDF0280BF283E7A6F45F35227
- MD5 SHA1 SHA512 SSDEEP TLSH