Analysis
- max time kernel
149s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/08/2026, 04:29
Behavioral task
behavioral1
Sample
2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
- Size 10.7MB
- Sample260819-e4qlksda29
- SHA256 d141b44bb8b996a0cece7e6506fcfeccfab0e0a923fa59f86700223cfb7e80a2
- MD5 c0b29aa8cb739ecd4e794feb648e1b00
- SHA1 925356f25e6d304aea975478f92175370509fc2f
- SHA512 b5fa9f6ab8ea01e66de87576ea950d69ce36d285f3da52e77a1cb3e9a965d11133a80ed3ee5e417b220140f2a34cf23788cfb85610ac7c3eff34e082077f8af1
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKS9joLFBD0jo3:vD1cISgTH2qBpu1QfLIqsuf5opBSo3
- TLSH T145B6192171E58FA8C05FD074CE4666A5AA633C458FB09FDF1580BE693E326E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\net.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\poqexec.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\fontview.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\NETSTAT.EXE 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\powercfg.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\UserAccountControlSettings.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\clip.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\CloudNotifications.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RpcPing.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\sc.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\winrm.cmd 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\chcp.com 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\control.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\format.com- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\resmon.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SystemPropertiesPerformance.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\control.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\Dism.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dllhost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\eudcedit.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\tracerpt.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mshta.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mstsc.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\printui.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\WerFault.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\wscript.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cipher.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\edpnotify.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\proquota.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\tree.com- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\winver.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\calc.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\replace.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\waitfor.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\dccw.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\eudcedit.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\cliconfg.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\getmac.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\more.com 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\odbcad32.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\OneDriveSetup.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\perfhost.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\reg.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\RMActivate.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\bootcfg.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\diskpart.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\grpconv.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\icsunattend.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\InstallShield\setup.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SysWOW64\raserver.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe -
resource yara_rule behavioral1/memory/5068-0-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/files/0x000a0000000242fc-5.dat upx behavioral1/memory/5068-516-0x0000000000400000-0x0000000000420000-memory.dmp upx behavioral1/memory/5068-3220-0x0000000000400000-0x0000000000420000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmprph.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Windows Media Player\wmprph.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\7-Zip\7zFM.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files\Internet Explorer\ExtExport.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_11.0.19041.1202_none_5b834788c0d17953\f\iexplore.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\r\uwfmgr.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.546_none_70569b662ddb706c\r\CameraBarcodeScannerPreview.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.1266_none_f5ba41fece31d7fe\r\SpatialAudioLicenseSrv.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-audio-volumecontrol_31bf3856ad364e35_10.0.19041.964_none_ae5ec9e59abc05e6\SndVol.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..kgroundtransferhost_31bf3856ad364e35_10.0.19041.746_none_76d2900542f0226c\f\BackgroundTransferHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\ApplySettingsTemplateCatalog.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ieframe_31bf3856ad364e35_11.0.19041.264_none_863c21753674f968\f\IESettingSync.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchIndexer.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.19041.84_none_40bd4149a6d52edb\r\AppVClient.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.1266_none_e8d910c7c702b558\f\MusNotificationUx.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_netfx-mscorsvw_exe_b03f5f7f11d50a3a_10.0.19041.1_none_99318cb064fcaf44\mscorsvw.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-format_31bf3856ad364e35_10.0.19041.1_none_e6ce9a885db7db4f\format.com- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ktmutil_31bf3856ad364e35_10.0.19041.1_none_48cfaff3d4e720e6\ktmutil.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1_none_80e38b0746f5a926\wmprph.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\AccountsControlHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.610_none_d94fa044111e8308\r\StartMenuExperienceHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1202_none_a5b2e5b8b986fe3d\r\wininit.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\Temp\PendingDeletes\e374984536e5d701109b00001815341f.iisrstas.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\r\CastSrv.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_8b53de27def16277\eventcreate.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wslconfig_31bf3856ad364e35_10.0.19041.117_none_7f3778d7035d9622\wslconfig.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.19041.1151_none_f7be996d8409bfa1\n\wsl.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filehistory-ui_31bf3856ad364e35_10.0.19041.746_none_2c2bcd67e9d4665c\FileHistory.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_4.0.15805.0_none_646d7347043be71c\aspnet_regbrowsers.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-host-service_31bf3856ad364e35_10.0.19041.1288_none_6c70124c60e2b4ef\r\vmcompute.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi_31bf3856ad364e35_10.0.19041.1_none_eae66734659b60d0\wowreg32.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rnetprinting-client_31bf3856ad364e35_10.0.19041.1288_none_ff9a0c377d92f65b\r\wpnpinst.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\msil_inspectvhddialog_31bf3856ad364e35_10.0.19041.1_none_cc14df174755d4a1\InspectVhdDialog.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_microsoft-windows-d..directplay4-payload_31bf3856ad364e35_10.0.19041.1_none_ba3fa9706f28b589\dplaysvr.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\SystemApps\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\PinningConfirmationDialog.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ebviewhost.appxmain_31bf3856ad364e35_10.0.19041.746_none_e873f3aa792d8bb3\r\Win32WebViewHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-xbox-gameoverlay_31bf3856ad364e35_10.0.19041.746_none_2703bed0ba809808\f\GamePanel.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.19041.173_none_2dc175215ae8ec39\r\winload.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.19041.746_none_5fb37340a423d88f\f\PrintBrmEngine.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-infrastructure_31bf3856ad364e35_10.0.19041.1_none_8b021141ec175d3e\sdbinst.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..n-tools-command-ldp_31bf3856ad364e35_10.0.19041.1_none_05325e2f9f9e6b0a\ldp.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-usoclient_31bf3856ad364e35_10.0.19041.1266_none_23ae8c0349f1b325\r\UsoClient.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\ScreenClipping\ScreenClippingHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoftwindowssystemrestore-tasks_31bf3856ad364e35_10.0.19041.84_none_2c3254d57443e050\SrTasks.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-disksnapshot_31bf3856ad364e35_10.0.19041.1081_none_f52da7b1195e2d45\DiskSnapshot.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\f\wmprph.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.19041.1_none_440e94288def3f95\mspaint.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux_31bf3856ad364e35_10.0.19041.1202_none_d081cba554088913\r\slui.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..-experience-apphelp_31bf3856ad364e35_10.0.19041.928_none_6a67731cf3e151f2\pcaui.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.19041.264_none_583d67d6d00b6b6a\f\WerFault.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_09c72ca259d82b1b\msiexec.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\omadmprc.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine_31bf3856ad364e35_10.0.19041.1266_none_82441dbab862ff6a\msoobe.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-driververifier_31bf3856ad364e35_10.0.19041.1_none_7ab192ed7079aec0\verifiergui.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\wow64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_9627a04e40f9f001\r\SearchFilterHost.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.19041.1_none_3c6036d4b220f210\InstallUtil.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dxp-deviceexperience_31bf3856ad364e35_10.0.19041.1_none_fd1639479924c51c\Dxpserver.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..-personalizationcsp_31bf3856ad364e35_10.0.19041.1_none_f6e35a697a06e63e\desktopimgdownldr.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ces-backgroundagent_31bf3856ad364e35_10.0.19041.1_none_b0876c2e7a0b3a5f\SpaceAgent.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-uimanagerbroker_31bf3856ad364e35_10.0.19041.388_none_57e235d809a12c5b\r\UIMgrBroker.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe File created C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.19041.84_none_c43e71af69351575\f\dstokenclean.exe- 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c0b29aa8cb739ecd4e794feb648e1b00_akira_amadey_cobalt-strike_elex_hijackloader_icedid_luca.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 11.2MB
- SHA256 c5e1e6755d4d6b9f84ac636819460660f25badc1bd7fe86f47a8df5917b57d20
- MD5 39c62336930912ca4ae23eed2a87c983
- SHA1 ce1e975740b91f03fb2d78fd0831b981961fec61
- SHA512 acd1341b315b6e762efcc6794e4f2c80b2e5a25ecf875e7c199507d8d4e54392c4bdf8fc8ec5e281afab38df20cc95412b2761c289eb92dc745138b74669252f
- SSDEEP 98304:vak1LapISKUgTH2M2m9UMpu1QfLczqssnKS9joLFBD0jonjoe:vD1cISgTH2qBpu1QfLIqsuf5opBSojoe
- TLSH T187C6191171E58FA8C06FD074CE4666A5AA733C458FB09FDB1580BE693E326E06E3521F
- MD5 SHA1 SHA512 SSDEEP TLSH