Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/08/2026, 03:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
- Size 936KB
- Sample260816-ef76qaba97
- SHA256 a8ef3c56a37bcd1e02f6a9282b678cb609aa7df9b420086b739930be95d9c5c5
- MD5 b0a5c4b5f254b9e9ad5f993e8640a4b2
- SHA1 a6b8e35edb431bbde10df29dc9442c8ddf66b74d
- SHA512 a7e5569e0c979c22ef414e17dd19827c93a0f471cca2c09680c5fd0df38f711fcc9a6b93c68e96ba81f764f7b66b563f9cf769046f906dcbea7d2ac181e3b95e
- SSDEEP 12288:C1gL5pRTcAkS/3hzN8qE43fm78VWDQeF5UfHOdXDPjH7MJzPnNUcCvX/:j5jcAkSYqyEWDPjHg9PnNUcQ/
- TLSH T108154A15F7A44675E073C179C9E29646EA723C451B30CACF1389A26D2F337E28939B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\pcaui.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wecutil.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\chkntfs.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\resmon.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\xcopy.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\msiexec.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WWAHost.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\BackgroundTransferHost.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskusage.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\NETSTAT.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tar.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\whoami.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\eventcreate.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\explorer.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\where.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\forfiles.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\grpconv.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\win32calc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_a9d04a55194853d2\kdnicctrl.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\icacls.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\srdelayed.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CameraSettingsUIHost.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dcomcnfg.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MRINFO.EXE 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\CheckNetIsolation.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\more.com 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\MuiUnattend.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\TSTheme.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\mmgaserver.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\PING.EXE 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\sfc.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\wscadminui.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\DevicePairingWizard.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SysWOW64\verifiergui.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseImdsCollector.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Defender\MpCmdRun.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Program Files (x86)\Windows Media Player\setup_wm.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.26100.1_none_f288deea5ef6349f\logagent.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-aspnet_state_exe_b03f5f7f11d50a3a_10.0.26100.1_none_255c949d766547ab\aspnet_state.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.CapturePicker_cw5n1h2txyewy\CapturePicker.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.26100.1591_none_70d0fee4fcc0ae07\r\sdbinst.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.26100.1_none_48488580f79252e6\wbadmin.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.26100.1591_none_9c7590519bc81879\vfpctrl.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\sort.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-win32calc_31bf3856ad364e35_10.0.26100.1150_none_e5966fa8c7a04cf1\win32calc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-compact_31bf3856ad364e35_10.0.26100.1_none_f6e8e32b1e1f23da\compact.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\r\setupugc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.26100.1_none_f43c30384cd30669\SystemPropertiesAdvanced.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5f97775aa22929cb\cacls.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.26100.1591_none_196dbbee022bb530\SpeechModelDownload.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-edge-microsoftedgecp_31bf3856ad364e35_10.0.26100.1150_none_5d1d8fd6c1063afd\MicrosoftEdgeCP.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.26100.1591_none_965659d18ab48b28\SpaceAgent.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.26100.1_none_200ace4b24b1d248\chkntfs.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-triggers-service_31bf3856ad364e35_10.0.26100.1591_none_c3e67f006d0c06f6\mqtgsvc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-osk_31bf3856ad364e35_10.0.26100.1591_none_467cce9309f588c5\osk.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\r\LaunchTM.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.26100.1591_none_dcb2480c8ab03707\desktopimgdownldr.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.26100.1_none_91c8eae9745a351d\SystemPropertiesRemote.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmLpac.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-chkdsk_31bf3856ad364e35_10.0.26100.1_none_c92eac93299dda10\chkdsk.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.26100.1_none_697667281e7cce2c\AppLaunch.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.26100.1_none_8306f62f1d2799f7\recover.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tieringengine_31bf3856ad364e35_10.0.26100.1150_none_4b5f1683145608dd\r\TieringEngineService.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.26100.1150_none_06d22316aa9884bc\vdsldr.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.Core_cw5n1h2txyewy\SnapLauncherProtocol.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_d3d0c423c229a48e\r\CHXSmartScreen.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\r\uwfservicingscr.scr- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizardElev.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.26100.1150_none_a91ae2d49210b003\MsSpellCheckingHost.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\chgport.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\bfsvc.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.26100.1301_none_61f509cbb778baf7\SndVol.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.26100.1_none_57c076d780640e4c\VSSVC.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.15912.355_none_7944a4ca9ef8c9af\aspnet_regiis.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_aspnet_regsql_b03f5f7f11d50a3a_4.0.15912.355_none_cca5d427d5c6dc80\aspnet_regsql.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.26100.1_none_819025e8f7dd72e4\DpiScaling.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..llercommandlinetool_31bf3856ad364e35_10.0.26100.1_none_7bb68dcb719a0f10\sc.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_10f229073c0ac263\r\SearchProtocolHost.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\r\WindowsSandboxClient.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.26100.1591_none_e29fcb0e6345d56d\rstrui.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\OOBENetworkConnectionFlow.exe 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.26100.1_none_8fc81fd68823646b\ComSvcConfig.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1_none_b3959cfa7e715aba\PasswordOnWakeSettingFlyout.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..dstore-schema-shell_31bf3856ad364e35_10.0.26100.1150_none_2fc55246563e15a2\r\readCloudDataSettings.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.26100.1591_none_03d08eaac76f1ba8\certreq.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-net-command-line-tool_31bf3856ad364e35_10.0.26100.1_none_4f25f9e0db03aa60\net.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\PATHPING.EXE- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-runtimebroker_31bf3856ad364e35_10.0.26100.1591_none_321363d9581bd94b\RuntimeBroker.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.26100.1150_none_4a33ec93078da3bd\r\sxstrace.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\change.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_73dcd67238fcc679\InfDefaultInstall.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodelreg_exe_b03f5f7f11d50a3a_4.0.15912.0_none_1695d375c2f4d597\ServiceModelReg.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.26100.1591_none_efac539d4dc51fdd\r\PktMon.exe- 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-16_b0a5c4b5f254b9e9ad5f993e8640a4b2_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.9MB
- SHA256 8146c4338194f8cbc5f470b0aff21d236c28ca367a1d3a4ba3c6274b1d3e7893
- MD5 e0c78dc017146ea6cc51998c3713fa08
- SHA1 a548a07bff2b3c7f88344e42f3a779dde55d5258
- SHA512 d2a44b91249b56d39d5ea487719bb3e32913cf5ac90c46832701e0bb8284bb73d52257dc9e7102424b2c8a10f3c5a602aa44fa242ace7c93a4388251455e37ce
- SSDEEP 24576:j5jcAkSYqyEWDPjHg9PnNUcQZa7/ezSC6vUyD/aqgrvWx6q8wyue:RpYqWPjH+PII/ezSC6vUzPvMHjyV
- TLSH T12B952A15F6788332D0B3D0B9C5D2AA5AFE7234465B308ACF0246976C2E377E68935B35
- MD5 SHA1 SHA512 SSDEEP TLSH