Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/08/2026, 22:30
Behavioral task
behavioral1
Sample
2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe
- Size 5.5MB
- Sample260819-2e9pgsvcrd
- SHA256 f199f588159afebf3ccc1d7067337c569aff42a995e622f8905a774e85447fdd
- MD5 8a722d53b49d05b7c3141f7e5d040e46
- SHA1 5c41d8f02fd4ece9fbce91d8027a062abdb90eed
- SHA512 6766eb79ef6cd94d3ee31810bf61605304c6b617fcac339aef2f2ed8f6aa36a13d197df58597043f3746212b6c7d4543225009a07c41e6cf629518f2d7a2e306
- SSDEEP 98304:Z3qqUHxqPF4VMNW6oKlTqvu4tm2EQPSnsuMXQPWmU6yhI28DrUZudC:ZaHxXME6oKlmu4tm2EQPSnsuMXQPWmUb
- TLSH T15E466C02F2A00195E073A734C5A55661EA363C515B35C6DFCAACB3186F7BAF09E3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\mofcomp.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmstp.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\EaseOfAccessDialog.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InstallShield\_isdel.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PackagedCWALauncher.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\getmac.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dtdump.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\instnm.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mcbuilder.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ROUTE.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\waitfor.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cscript.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasphone.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\typeperf.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cmdkey.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\tzutil.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\whoami.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wowreg32.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\dfrgui.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\iscsicli.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ntprint.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\eventcreate.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wbem\WmiPrvSE.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\ndadmin.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\TpmInit.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\cttunesvr.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\mmgaserver.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\CloudNotifications.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\runonce.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SearchIndexer.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesProtection.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\wermgr.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\Com\comrepl.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\diskpart.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\PkgMgr.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe -
resource yara_rule behavioral2/memory/5096-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/files/0x001200000001c3e1-5.dat upx behavioral2/memory/5096-620-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral2/memory/5096-2915-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Mail\wabmig.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpService.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\ApproveChildRequest.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1_none_e271ed51a0d2c02e\extrac32.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dispdiag_31bf3856ad364e35_10.0.26100.1591_none_e0a4647be01e0453\r\dispdiag.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rasautodial_31bf3856ad364e35_10.0.26100.1150_none_abc14f2d153d07e6\rasautou.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.26100.1_none_67ad1b14943183e5\netbtugc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.26100.1_none_7c88976e8785ad0a\mscorsvw.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.26100.1_none_bb53ccdac90dda7a\RegAsm.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.BioEnrollment_cw5n1h2txyewy\BioEnrollmentHost.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\XBox.TCUI.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\r\ExtExport.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\r\rpcinfo.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-defender-service_31bf3856ad364e35_10.0.26100.1_none_c299cb2ebf592e77\MpDefenderCoreService.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iondata-cmdlinetool_31bf3856ad364e35_10.0.26100.1150_none_24124d3c551588ce\r\bcdedit.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.26100.1591_none_37fa9a7337d181ee\UwfServicingSvc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.26100.1_none_9d1627fd03aed8d9\LogCollector.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ommandlineutilities_31bf3856ad364e35_10.0.26100.1_none_8465405a0441f0fb\doskey.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-deployment_31bf3856ad364e35_10.0.26100.1591_none_97aef1f19d54d967\r\setupugc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1150_none_fd0acb47aebf06db\logman.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.26100.1_none_df337d63f8ff3ba4\iscsicpl.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wusa_31bf3856ad364e35_10.0.26100.1_none_b448e42fb58a37ac\wusa.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sensordataservice_31bf3856ad364e35_10.0.26100.1150_none_99eb378dda259f30\SensorDataService.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_security-octagon-broker_31bf3856ad364e35_10.0.26100.1150_none_f5f28f643cc492d0\r\SgrmBroker.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.26100.1_none_d3f029e4b58d022b\iexplore.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.1150_none_69add7d861f392a8\AddSuggestedFoldersToLibraryDialog.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..screencontentserver_31bf3856ad364e35_10.0.26100.1150_none_a32ebc355a703318\r\LockScreenContentServer.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-u..onwakesettingflyout_31bf3856ad364e35_10.0.26100.1_none_b3959cfa7e715aba\PasswordOnWakeSettingFlyout.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-impexp-extexport_31bf3856ad364e35_11.0.26100.1150_none_0d9d250a9ce416ba\ExtExport.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ping-utilities_31bf3856ad364e35_10.0.26100.1150_none_4518f57e3fc4b0d8\PATHPING.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.26100.1150_none_90fe1fffae58c8c8\RMActivate_ssp_isv.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-workspaceruntime_31bf3856ad364e35_10.0.26100.1150_none_c24c8b338d2c21f3\wksprt.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.26100.1_none_686bcd839bc27ad8\logman.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-acluifilefoldercomtool_31bf3856ad364e35_10.0.26100.1_none_5542cd086dc867d0\cacls.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_4a8c1df49b9afb5a\Taskmgr.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..alenrollmentmanager_31bf3856ad364e35_10.0.26100.1591_none_4177de30403bfb76\r\CredentialEnrollmentManager.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-s..opertiesperformance_31bf3856ad364e35_10.0.26100.1_none_621effe29fc799ae\SystemPropertiesPerformance.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.26100.1_none_69882c20049c047e\InfDefaultInstall.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.26100.1150_none_37adcb75a8302256\WindowsActionDialog.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1_none_8fd24ad09e1634f0\ktmutil.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.26100.1_none_3b8c278ba0146cc8\tzutil.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-client-li..m-service-migration_31bf3856ad364e35_10.0.26100.1742_none_32a8c94cc5f2eef2\ClipUp.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.26100.1_none_a7bc2b43865e8120\fsavailux.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.26100.1150_none_24714894b112c0f3\r\ktmutil.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-admincmdtools_31bf3856ad364e35_10.0.26100.1150_none_50956d2d42f20d39\rpcinfo.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_10.0.26100.1591_none_f7c94c8b5e2407fe\explorer.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-forfiles_31bf3856ad364e35_10.0.26100.1150_none_f10ac0168d72b2cd\r\forfiles.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.26100.1591_none_bd195c301c7f4e60\lpksetup.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-disposableclientvm_31bf3856ad364e35_10.0.26100.1591_none_815687268bc7e515\WindowsSandboxClient.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.26100.1591_none_88f13a0c22218100\IMJPUEX.EXE- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-mdmdiagnosticstool_31bf3856ad364e35_10.0.26100.1150_none_fae82cdc22c5f652\MdmDiagnosticsTool.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.26100.1150_none_1da178eaf53e7c4d\PrintBrmEngine.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_10.0.26100.1150_none_85392e759f939eae\RMActivate_isv.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-easinvoker_31bf3856ad364e35_10.0.26100.1_none_8917e9dc16872bc9\easinvoker.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-controlpanel_31bf3856ad364e35_10.0.26100.1_none_dc671a88c37dde08\tabcal.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.26100.1591_none_ccb2b3f5b4577de6\r\wininit.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\SystemApps\MicrosoftWindows.Client.OOBE_cw5n1h2txyewy\OobeHostApp.exe 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-csvde_31bf3856ad364e35_10.0.26100.1150_none_f7257bce926ea30a\r\csvde.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..andlinepropertytool_31bf3856ad364e35_10.0.26100.1150_none_a7249f5f30c44921\r\imjpuexc.exe- 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_8a722d53b49d05b7c3141f7e5d040e46_akira_amadey_cobalt-strike_darkgate_elex_icedid_njrat_vidar_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 6.4MB
- SHA256 a56065edc9734d648b212b3f59a6317aa146ba10480c044aa5e37af45054364a
- MD5 3d6c2713d94828b2b538dda076c0c151
- SHA1 63c691c5e7a7b2d0b8c544a4e0e8faa7758db122
- SHA512 e863af7a4e1e73a6a89dc23f4b38d13c3c9cd01a79d0d7ffc70ca258aff551a71349b95cee6e30d5ce3b7cc3b9f66e54aba974804540989879d49448312c742d
- SSDEEP 196608:ZaHxXME6oKlmu4tm2EQPSnsuMXQPWmU6yhI2IgcdgK:ERXMzdlmhtm2EQPSnsuMXQPWmU6yhI2E
- TLSH T17B665B02F2B40265E073E674C5A66665EA323C415B34C6DF866DB3182E7B6F09E3D732
- MD5 SHA1 SHA512 SSDEEP TLSH